Is it possible to recover the old version of a file after a save via file recovery programs.
Example: basic text file.txt
Open file
Edit file
Save as same file name in same folder
Any way at all even if expensive or requires restricted stuff to read through that oversave.
I was asked by a lawyer yesterday if this was possible, I said to the best of my knowledge no, but thought I would toss the Q out to the dopers for a broader base of answers if any.
It may be possible, but it would be a job for a very expensive data recovery expert, AND it might all be for nothing.
Firstly, there’s no guarantee that an operating system will overwrite the bytes belonging to version A of a file with the bytes belonging to version B, saved as the same filename - particularly if version B is bigger, the OS might just save version B in a new block of space, ‘deleting’ version A - except that deletion often consists of just removing the reference to the file in the file allocation table or master file table, or whatever it happens to be - the bytes might still be there on the disk.
Furthermore, even if the file was overwritten in situ, apparently, highly-skilled data recovery folks can still work out what was there beforehand - the disk surface is magnetised in little spots or domains, each one representing a bit - when one of these domains changes state, apparently what happens is that the previous magnetised stat doesn’t disappear entirely, it gets pushed out to the perimeter of the newly-magnetised domain, so any given domain is surrounded by a concentric set of rings representing previous states.
However, recovering actual data from that is going to be tricky, hugely expensive and probably highly unreliable/unlikely for anything beyond plain ascii text.
Anyway, what it boils down to is that data can often be recovered even if apparently overwritten, but the more use the file system has seen since the deletion/overwrite, the less likely recovery is to succeed, and the more expensive gets the attempt.
It’s possible. How likely and how expensive depends on a lot, like Mangetout said. However if you want to try it out there are some inexpensive data recovery programs out there (go to your local computer store and see what they’ve got), including things that will “undelete” files, recover data from re-partitioned drives and so on.
The ability to recover a deleted file goes down as that data is overwritten on the hard drive. If you just delete something, it’s relatively trivial to recover. If you save a new version, as Mangetout said, there’s no guarantee that the new version will actually overwrite the old version so it may also be trivial to recover. This is why data shredding (secure file erase) apps do multiple overwrites of the hard drive, to prevent data recovery. Deleting all data or re-partioning the drive isn’t very secure since the original data isn’t actually gone. Overwriting the entire drive once is a good first step since it obliterates most (but not all) of the original data. Doing multiple overwrites is better (a commonly-used standard way to securely destroy data is to overwrite it three times with certain patterns of bits; I’ve got various utilities that will do up to 35 overwrites but that takes so long you might as well physically destroy the drive platters).
You stand a decent chance if it’s a text file as in your example. Disk scavenging programs told to go find text blocks will bring you back 10 trillion “files” with names like Text File 00001, Text File 00274, Text File 13195, etc etc. All you have to do is open and read every one of them (or tell your text editor to search every one of them simultaneously for a specific search-string) and maybe one of them will contain the text as it existed before you edited and saved.
If it’s a movie, image, or soundfile you’re editing, a FileMaker dabatase you’re making changes to, a binary executable you assaulted directly with a resource editor, etc, it’s less likely (like 0%) than any recoverable fragment will be openable and useful, so you’d have to be lucky enough to recover the entire file, which would’ve been decently likely had you merely deleted the file and then went to recover it almost immediately, but after modifying in an unfortunate way and then saving? La problema.