I clobbered a file by saving a download with the same name, and would like to recover my data.

April 24, 2007 10:03 AM

I clobbered a file by saving a downloaded file with the same name. Options?

OK, I have searched past questions and the nearest hit I found was this one, which seems distinct from my situation. Here's what happened:

1) Edit file on computer 1, email to self
2) D/L file to computer 2, edit in MS Word, save.
3) Forget that I had edited, download from email over the edited copy!

This is different from the situation in the post above, because there it appeared that doing a ctrl-S also clobbered all the autosaved copies; in my situation that's (hopefully) not the case. Obviously the advantages of CVS or Perforce are now vividly clear to me, but now is the time for data recovery, not self-flagellation.

So, what can I do to get the version I had saved in step 2? If there are autosaves, where are they (Office 2K on Windows XP)? Or, is there a free/cheap tool that can search unallocated blocks so that I could at least maybe recover the unformatted text and paste it into a new document? I'm assuming here that clobbering the filename does not also place the new file in the same disc blocks, though the FAT will obviously no longer point to the old blocks.

Anything else I could try? The data (and my time) are worth enough that the situation might merit downloading a commercial tool, but not hiring an outside recovery service.

posted by rkent to Computers & Internet (5 answers total)

Unless you're using a copy-on-write/log-structured filesystem like ZFS, it'll most likely have overwritten the blocks the original file was using, especially if the new file fits nicely. If it hasn't already, it'll happen sooner or later while the disk is used.

Your first move is probably going to want to be making an image of the disk to another drive (ideally on a system which doesn't have the disk mounted read/write; a *ix LiveCD like Ubuntu would be perfect) using something like dd (not Ghost; you want to copy "free" blocks too). This preserves the state of the disk so you can try destructive recovery tools without worrying too much about making things worse -- if it all goes wrong, you can always dd the image back to the disk.

If undelete tools don't help, you also have a whacky big file you can search for fragments of your document.
posted by Freaky at 10:41 AM on April 24, 2007

Response by poster: Unless you're using a copy-on-write/log-structured filesystem like ZFS, it'll most likely have overwritten the blocks the original file was using, especially if the new file fits nicely.

Really? No, I'm just using NTFS. Damn.
posted by rkent at 10:46 AM on April 24, 2007

Response by poster: Ah HA! I used Ntexplorer to scan the free sectors and found at least the text of the portion that I overwrote. Sweet!
posted by rkent at 11:30 AM on April 24, 2007

\o/

You have a lot more chance of recovery with an overwrite which unlinks the original file first; most filesystems mostly guarantee if you open a file, write a load of data, then open it again and write over the original data, that you actually get written to the location of the original data; otherwise it has to mess about with block allocations. This behavior is depended upon by things like secure delete tools which would otherwise need to hook into a much lower layer of the OS to function.

Unlinking the old file first (which a downloader *might* have done) will break this "guarantee", but it could still reuse the blocks anyway, since they're now free. Apparantly in your case you got lucky, yay.

Now go set up hourly incremental backups or version control (see Subversion/TortoiseSVN).
posted by Freaky at 12:44 PM on April 24, 2007

Response by poster: or version control

Yeah. Ironically, I have an installation of Confluence wiki, which has version control for attachments, but I hadn't attached this file to a wiki page yet. Now, needless to say, I have.
posted by rkent at 1:06 PM on April 24, 2007