Document recovery

Factual Questions
1

Please Help.

A friend of mine has just saved another document over the top of his 5000 word essay. Then he saved it over the backup as well (don’t ask)

He’s using MS Word 2000 and Win 98. Auto backup was off.

The file he saved on top of the original one is only about half the size, so it’s possible some of the data from the original file is on the disk.

If anyone has any thoughts on how we could attempt to recover that data they would be appreciated.

Please, no this can’t be done posts. I know how unlikely it is we’ll be able to recover anything

. Thanks

Gartog

2

He could try looking in the temp directory for files of appropriate size for the date/time he was working on the document.

3

It is unlikely the original data gets overwritten. What happened is Windows found some unused space on the HDD, wrote the new info there, and then point the directory entry to the new space.

So, in theory, he can recover the data by searching through the HDD using a sector editor. It’s a hard job that requires specialised knowledge. Perhaps there are automated software tools out there that can be used. Search around the Web.

4

Meanwhile, don’t save any information to the disk.

5

If it’s VERY important, a data recovery service could get it back for you…but they’re expensive. I think you’d have to phone them for a quote, but you’re talking thousands of dollars here (probably).

Otherwise, looking in temp is your best bet…though if it saved cleanly, it’s a long shot.

Bit of bolt door/horse gone stuff: make important backups to CD-R. They’re dirt cheap and you can just add dates to the filename to identify them easily. No risk of accidently overwriting.

In fact, even on the HD, Save As… important files with the date in the name. Word will sometimes screw up files anyway, and it makes it easy to go back a revision or two. Drive space is cheap; use it.

Another thing you can do is get a free web based email, and email a copy to yourself as an attachment…this is good because it’s off site (encrypt first if you need it secure).

Sorry this won’t be much help to you, but maybe for future reference. Good luck.

Just seen Urban Ranger’s comment in preview. He’s right, but it depends on how much you’ve done with the computer since and what filesystem you have…I could be wrong, but doesn’t NTFS tend to avoid fragmentation anyway, like ext2fs? Would probably overwrite anything deleted.

6

Thanks for all the comments.

I tried the temp directory, no luck. I also tried an undelete program, I wasn’t really expecting it to find anything, and it didn’t.

dylan_73 I will pass your comments on to my friend (In addition to my own warnings).

Thanks again for everyone’s comments

7

Urban ranger I thought of using a sector editor, I have used them before but I didn’t have time today. he has used the computer since - it was a few days ago when he saved over the other file, but he didn’t notice at the time.

He still has all his research notes, so it’s just a case of retyping the essay. Still it looks like his weekend away has to be cancelled.

8

FYI, working for J&J about 4 years ago we needed to get data from a drive that required a recovery service. Expect upwards of $10,000 if they have to disassemble the drive in a clean room, but they often have software tools to do it for less if its possible.