A longer text file was overwritten with a shorter one with the same name. I need to restore the previous longer version. The file system is NTFS. Almost nothing was neither written nor removed from the disk after I've noticed the problem.
I need a tool to gain binary/hex access to the disk, locate the existent version and trace the data going further (the previous longer text segment). The disk is not much fragmented.
Any suggestions. Any Linux, Windows or DOS tools would be acceptable.
-
1I think your question is (indirectly) answered in this question itself softwarerecs.stackexchange.com/questions/251/… (testdisk & photorec) – Xen2050 Jan 16 '19 at 23:21
-
1Possible duplicate of File Recovery Software – Xen2050 Jan 16 '19 at 23:21
As long as you know file systems and you can deal with a forensic level software, I can recommend AccessData TFK Imager Lite.
- It is free
- It works on Windows
- It is a tool for data recovery/forensics
- It displays your disk as Hex data
- no limitations other than it's an older version
Downsides:
- not very easy to use
- you'd better know what you're doing
Ideally you create an image of the disk and then do the recovery operations on that image, so nothing can overwrite the file in the meanwhile.
Just a hint for your case: very small files might be stored in the MFT completely. That way it may happen that the complete file content is still available. However, it may be hard to find the file because the MFT entry has been reused.
Recommended reading: Windows Internals book, the chapter about NTFS.
answered Jan 17 '19 at 15:48
