Overwritten files

  • Thread starter Thread starter CWatters
  • Start date Start date
C

CWatters

Ok first off I don't actually have a problem - I'm just interested to
know....

If you overwrite a file using Windows Explorer (eg you OK the warning
message) is the file usually physically overwritten on the drive? or is the
new one be created somewhere else on the drive and the old one deleted? What
are the chances for data recovery?
 
Ok first off I don't actually have a problem
- I'm just interested to know....
Click to expand...
If you overwrite a file using Windows Explorer (eg you OK the warning
message) is the file usually physically overwritten on the drive? or is the
new one be created somewhere else on the drive and the old one deleted?
Click to expand...

Yeah, basically.
What are the chances for data recovery?
Click to expand...

Pretty good much of the time.

It really depends on what algorithm is used to decide where the
new file will be written, and how the old file fits into that location
wise. Clearly in some situations where there isnt much free space
and the files are large, the new file may well be stored where the
old file was. But that wouldnt be very common at all with the more
common situation of quite a bit of free space and smaller files.

It isnt hard to test either, just use one of the undeleters and try it.
 
CWatters said:
Ok first off I don't actually have a problem - I'm just interested to
know....

If you overwrite a file using Windows Explorer (eg you OK the warning
message) is the file usually physically overwritten on the drive? or is the
new one be created somewhere else on the drive and the old one deleted? What
are the chances for data recovery?
Click to expand...

You can only find out by actually trying. If the FS is NTFS chances are poor
I think. I observe that files which are deleted most recently are the first
to be re-used. That is, their MFT entries are re-used. I haven't yet tested
if the clusters are also used first. In case the latter is false you may
have a chance using a tool that scans for file headers, for example Davory
from www.winhex.com.
 
CWatters said:
Ok first off I don't actually have a problem - I'm just interested to
know....

If you overwrite a file using Windows Explorer (eg you OK the warning
message) is the file usually physically overwritten on the drive? or is the
new one be created somewhere else on the drive and the old one deleted?
Click to expand...

It depends on the mode the file is opened with. A plain replacement of an
existing file by another, with the same filename, writes the new file elsewhere
and frees the space that was allocated to the previous copy.
What are the chances for data recovery?
Click to expand...

It depends on disk usage and the time that elapsed since the space was
deallocated. Chances to recover decrease as unassigned space is reallocated to
new disk writes.

Successful recovery depends on run time since deallocation, fragmentation of the
erased file (only contiguous files can be fully recovered), and having a
distinguishable header type (e.g. Office OLE files, most formats of image files,
etc.). Such program is my ResQdata, and there are others.

Regards, Zvi
 
Back
Top