A longer text file was overwritten with a shorter one with the same name. I need to restore the previous longer version. The file system is NTFS. Almost nothing was neither written nor removed from the disk after I've noticed the problem.
I need a tool to gain binary/hex access to the disk, locate the existent version and trace the data going further (the previous longer text segment). The disk is not much fragmented.
Any suggestions. Any Linux, Windows or DOS tools would be acceptable.
-
1I think your question is (indirectly) answered in this question itself softwarerecs.stackexchange.com/questions/251/… (testdisk & photorec)– Xen2050Jan 16, 2019 at 23:21
-
1Possible duplicate of File Recovery Software– Xen2050Jan 16, 2019 at 23:21
-
Most definitely not a duplicate of File Recovery Software as this is much more specific and recovering that specific text file is not what file recovery software will easily achieve.– Joep van SteenApr 12, 2021 at 15:36
Add a comment
|
2 Answers
As long as you know file systems and you can deal with a forensic level software, I can recommend AccessData TFK Imager Lite.
- It is free
- It works on Windows
- It is a tool for data recovery/forensics
- It displays your disk as Hex data
- no limitations other than it's an older version
Downsides:
- not very easy to use
- you'd better know what you're doing
Ideally you create an image of the disk and then do the recovery operations on that image, so nothing can overwrite the file in the meanwhile.
Just a hint for your case: very small files might be stored in the MFT completely. That way it may happen that the complete file content is still available. However, it may be hard to find the file because the MFT entry has been reused.
Recommended reading: Windows Internals book, the chapter about NTFS.
answered Jan 17, 2019 at 15:48
A longer text file was overwritten with a shorter one with the same name
How much shorter, give actual file sizes. As Thomas Weller correctly says, if small enough the data attribute of the text file will be what NTFS calls 'resident', while the larger file probably wasn't. Resident means it fits inside the 1 KB MFT entry alongside the meta data.
If same MFT entry is used to store smaller file references to clusters of the larger original are now gone.
Best generic approach would be perhaps the simplest: Search drive for a text string that you know for certain to be present in the text file using something like HxD (free). Once found it will be relatively easy to locate and select all blocks that were part of your text file, and export it to a txt file. I have helped people recover bitcoin wallets using this same method.