3

A longer text file was overwritten with a shorter one with the same name. I need to restore the previous longer version. The file system is NTFS. Almost nothing was neither written nor removed from the disk after I've noticed the problem.
I need a tool to gain binary/hex access to the disk, locate the existent version and trace the data going further (the previous longer text segment). The disk is not much fragmented.
Any suggestions. Any Linux, Windows or DOS tools would be acceptable.

3
1

As long as you know file systems and you can deal with a forensic level software, I can recommend AccessData TFK Imager Lite.

  • It is free
  • It works on Windows
  • It is a tool for data recovery/forensics
  • It displays your disk as Hex data
  • no limitations other than it's an older version

Downsides:

  • not very easy to use
  • you'd better know what you're doing

Ideally you create an image of the disk and then do the recovery operations on that image, so nothing can overwrite the file in the meanwhile.

Just a hint for your case: very small files might be stored in the MFT completely. That way it may happen that the complete file content is still available. However, it may be hard to find the file because the MFT entry has been reused.

Recommended reading: Windows Internals book, the chapter about NTFS.

1

A longer text file was overwritten with a shorter one with the same name

How much shorter, give actual file sizes. As Thomas Weller correctly says, if small enough the data attribute of the text file will be what NTFS calls 'resident', while the larger file probably wasn't. Resident means it fits inside the 1 KB MFT entry alongside the meta data.

If same MFT entry is used to store smaller file references to clusters of the larger original are now gone.

Best generic approach would be perhaps the simplest: Search drive for a text string that you know for certain to be present in the text file using something like HxD (free). Once found it will be relatively easy to locate and select all blocks that were part of your text file, and export it to a txt file. I have helped people recover bitcoin wallets using this same method.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.