recover overwritten files

[Guest]

Is there a way to recover files that are overwitten before they can be backed up? We have a Windows 2000 server with a raid configuration if that does any good. A client computer copied data onto the server and accidently replaced newer data on the server.

 

[Pegasus \(MVP\)]

Remove the disk(s) immediately and hand them over to a data recovery bureau.
They may be able to recover those files that have not yet been overwritten.
Ask them for their fee up-front.

Is there a way to recover files that are overwitten before they can be

backed up? We have a Windows 2000 server with a raid configuration if that
does any good. A client computer copied data onto the server and accidently
replaced newer data on the server.

 

[Lanwench [MVP - Exchange]]

You might want to check out www.undelete.com - do it soon before much
further activity has been written to disk. Don't know if it will work given
that the files weren't actually deleted.

 

[Enkidu]

(Hijacking Pegasus' post since the original did not get to my local
server. Sorry Pegasus.)

I'd be inclined to say to the user that there is no way to recover it.
Which is essentially true. The advantages of this approach are that
you don't have to attempt a data recovery, or install an extra utility
that may save users from themselves, and the user will learn to be a
little more careful in future. For a while at least. If, by superhuman
feats of data recovery, you manage to recover the lost data then the
user has no incentive to be more careful.

Assuming nightly backups, it may be quicker to redo the changes to the
document than to recover it anyway.

After all, to accidentally save a document over a newer document, the
user must have replied "yes" to the overwrite prompt?

Cheers,

Cliff

 

[Pegasus \(MVP\)]

See below.

(Hijacking Pegasus' post since the original did not get to my local
server. Sorry Pegasus.)

Fine by me!

I'd be inclined to say to the user that there is no way to recover it.

Not quite. As it happens, it is almost impossible to completely and
permanently erase data recorded on a hard disk, short of melting it
down. In theory, grains on the platters are either magnetised or
demagnetised. In practice, there are degrees of magnetisation and
degrees of demagnetisation, and with the appropriate tools you can
work out the recent history of a given particle, perhaps up six events
deep. Unfortunately for the OP, this sort of technology is way beyond
the budget of your average computer user, and is probably only
used by the likes of the FBI or the Defense Department.

The same actually applies to RAM, although to a lesser degree.

 

[paul Dietrich]

See below.



Fine by me!


Not quite. As it happens, it is almost impossible to completely and
permanently erase data recorded on a hard disk, short of melting it
down. In theory, grains on the platters are either magnetised or
demagnetised. In practice, there are degrees of magnetisation and
degrees of demagnetisation, and with the appropriate tools you can
work out the recent history of a given particle, perhaps up six events
deep.

Which is why any data destruction utility worth crap overwrites multiple
times.
However, we can presume that data was not delibrately destroyed.

Unfortunately for the OP, this sort of technology is way beyond
the budget of your average computer user, and is probably only
used by the likes of the FBI or the Defense Department.

Well, and data recovery specialists


There are also a few possibilies where you may be able to recover
fragments from (provided the source was destroyed). (Usefulness depends on
type of file)

1) the pagefile -- if the file was accessed recently, it was brought into
memory. And just possibly it was paged. If it was frequently accessed,
there may be enough pieces remaining to recontruct a whole file. Of
course, this is something that usually only a specilist can pull off.

2) slack space. Disks are formatted so that even the tiniest files take up
at least one block of space. The actual size varies). The leftovers are
called slack space. This space #may# contain peices of old files not
completely overwritten.

THe problem, of course is tnhe amount of time and money it takes. You must
evaluate what that data is worth to you.