Jump to content
Search In
  • More options...
Find results that contain...
Find results in...
spiritmaze

accidentally replaced a file on hard drive

Recommended Posts

Hi guys,

 

An urgent question here about recovering replaced/overwritten files.

I was moving some files into my external seagate hard drive and annoyingly I accidentally replaced a folder there that had the same name.

This was done on a mac, not windows (usually windows just merges the files if they have the same name).

After the folder was in the process of being replaced I realized instantly what was happening and I cancelled the action while it was still transferring the files, but it was too late and a new image for the folder was created, overwriting all the old files in the folder. I was not able to undo this action. This is a major flaw in the OS X operating system.

I've done quite a bit of research online about this matter, which is a surprisingly common disaster for some people. Replacing a file is much much worse than accidentally deleting a file. Deleted files can be recovered quite easily, but it seems overwritten files are a lot more complex. Files that are overwritten are analogous to writing something in pencil, rubbing it out and then writing something new on top of it. But there are conflicting reports on this and it seems there are many people online who have recovered overwritten files, however there's also many reputable sites that claim that overwritten file recovery is a lost cause.

However, there's a few things that might save me. Firstly, the original file was huge- at least 20 gigs. The new folder that overwrote it was tiny by comparison at around 500 megabytes. This means that potentially only 500 megabytes of the 20 gigs was overwritten, if that, because i cancelled the transfer after 10 seconds. Hopefully a large bulk of the original 20 gig file is still hiding somewhere on the external hard drive.

Here are the specs:

 

- I was using a macbook air, dragging files onto a seagate external hard drive. The replaced file was on the seagate, replaced by a file dragged over from my mac.

- The file destination was the external hard drive so I'm assuming if there's anything to recover it will be on the external hard drive, not the macbook.

- MacBooks use a destination file system that is HFS, however the seagate apparently converts it NTFS. I'm unsure if the file destination is HFS or NTFS in my case, and if this makes much difference to ease of file recovery.

- I have not touched the hard drive since I replaced the folder by mistake. I have advoided writing anything new to the hard drive incase it overwrites hidden data I might be able to salvage.
- I think my seagate is a SSD, which apparently is beneficial in the likelihood of recovering overwritten files.

In conclusion, I think my biggest likely saving grace here is that I didn't overwrite the 20 gigs with an equivalent huge file. Intuitively this feels like the original files must still be buried somewhere on the hard drive, but I am far from a computer tech. I'm hoping the extremely tech savvy people on Doomworld can assist me with a prognosis and possible course of action.

 

And yes, I know I should be backing up my files. Ironically the seagate was acting as my backup hard drive and I was dragging files there in order to back to them up. Ouch.

 

 

Share this post


Link to post

What was in there that you posted a thread about it on the Doom Editing forum?

And I seriously doubt you folder is there anymore. Check the total amout of disk space available on that external hard drive. If you see the space increased (the folder you accidentally transferred is smaller than the one that was replaced) than before, I doubt you can recover it.

It's times like this where you move on and restart.






This means that potentially only 500 megabytes of the 20 gigs was overwritten, if that, because i cancelled the transfer after 10 seconds.



That logic sounds like bullshit, but it depends on exactly how the files were being overridden.
Example



D: drive

file.txt
file.zip
file.exe
file.msi
file.ogg
file.mp4


Is my backup drive.

And this



C: drive

file.exe
file.msi
file.ogg


Is my main disk.

So I transfer the contents of C: to D: and basically

D: drive

file.txt 
file.zip
*file.exe
*file.msi
*file.ogg
file.mp4


And 3 out of 6 files were overridden. The other 3 are intact.

But



D: drive

/home
/file


If I have all those file.exe, file.ogg, etc under /file and my C: drive also has a folder called /file then



D: drive

/home
*/file


The whole /file folder gets overriden with the new one (unless the contents are merged).

====


And potentially corrupted too. I have a flash drive with unfinished corrupted files because the transfer was interrupted (power loss).

Edited by Voros

Share this post


Link to post

doom mapping stuff and videos were within the folder. Maybe a mod needs to move this thread to another section?

I figured the most tech savvy people would be in this particular section of the community.

 

Also, you're wrong about the file space on the hard dive being an indication of whether a file is still there. When a file is deleted then the harddrive marks it as free space available for new data, but it doesn't actually overwrite it until new data is loaded onto the harddrive. Writing new data onto the hard drive would permanently overwrite it. Think of it like erasing something you've written in pencil, but still being able to read what you've written because of the lines the pencil has pressed into the paper. If you were to write a new sentence of the erased sentence, then that would permanently obscure the original data.

The total space on my hard drive is 2 terabytes, so plenty of room for it to hide my replaced file.

Share this post


Link to post

You could always start fresh, since it doesn't seem to be anything serious, like work-related.

Share this post


Link to post

Yeah that was some irreplaceable personal stuff on there. I'm not overly precious about these things, but it would be good to know if there's a way to retrieve overwritten files.

Starting fresh is the last resort, and the least desirable.

Share this post


Link to post

i saw the extra info you added. Yeah that's exactly right, but apparently this is not always the case. Having a SSD makes a big difference in how files are overwritten apparently. 

 

Share this post


Link to post

Is there any difference? Data is data after all. SSD's have the advantage of fast data access, but that's all I ever bothered to know.

Share this post


Link to post

SSD partition files differently. When files are replaced, there are hidden previous versions of the files partitioned in the hard drive. But the internet is so confusing with all the conflicting information.

This is all new knowledge for me too. I only started researching it today and it's quite interesting.

Making sure data is permanently scrubbed from your computer is actually an industry in itself. To permanently scrub data you have to overwrite the entire hard drive with a special code to remove all shadows of it. This is important for government computers and protecting state secrets etc, and avoiding hackers.

 

Share this post


Link to post

If I were you, I'd move on. I can already tell the task won't be easy, given how there's a whole industry just for data management or whatever the term is.

You might want to hire a professional. Ask around at a site like Stack Overflow.

Share this post


Link to post

Seconded. Stack Overflow would probably be your best bet.

 

Sorry to hear that this happened.

Share this post


Link to post

The first thing I'd try is PhotoRec. It is easy to use, requires no specialist knowledge and doesn't alter the data - it just reads what it can and outputs it to a different disk/partition.

 

However, I suspect this may be beyond what it can handle (primary use is recovering photos from corrupted SD cards). But it is worth trying before deciding whether to pay for expert assistance.

Share this post


Link to post

You best chance is the following:

On another computer, find an undelete program that can run without an install, and copy it on a USB thumb drive. DO NOT use the computer with the overwritten files for this. Once you have the undelete program on the USB, put it in the computer with the overwritten files, and run it. Let it recover the files it can to another drive, or the USB drive. 20 Gb is pretty large, so you may need to use an external drive instead.

 

The whole point is to not cause any more files writes to the drive. They could choose the overwritten file space to store their data.

 

Good luck.

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×