Tech: Can I undo an overwritten Notepad file ?

Subject: Tech: Can I undo an overwritten Notepad file ?
From: Murray MacLeod
Date: 24 Feb 10 - 06:15 AM

I have just done something really stupid, I thought an existing Notepad file contained data other than what it did contain, and I saved another file giving it the same name.

Is there any way I can reclaim the original, overwritten file ?

I have checked the Recycle Bin, but it doesn't seem to be there ....

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: Hamish
Date: 24 Feb 10 - 06:31 AM

Seems unlikely. This, from Wikipedia:

When data have been physically overwritten on a hard disk it is generally assumed that the previous data are no longer possible to recover. In 1996, Peter Gutmann, a respected computer scientist, presented a paper that suggested overwritten data could be recovered through the use of Scanning transmission electron microscopy.[8] In 2001, he presented another paper on a similar topic.[9] Substantial criticism has followed, primarily dealing with the lack of any concrete examples of significant amounts of overwritten data being recovered.[10][11] To guard against this type of data recovery, he and Colin Plumb designed the Gutmann method, which is used by several disk scrubbing software packages.

Although Gutmann's theory may be correct, there's no practical evidence that overwritten data can be recovered. Moreover, there are good reasons to think that it cannot.[12]

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: GUEST
Date: 24 Feb 10 - 08:02 AM

Try

http://www.active-undelete.com/faq-file-overwritten.htm

or

http://www.stellarinfo.com

Both are going to cost. You need to do it as quickly as possible to reduce the chance the data has been overwritten.

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: Hamish
Date: 24 Feb 10 - 09:26 AM

But those sites are for files that have been deleted and may have been overwritten. Murray's problem is that he knows that it's been overwritten, cos he's overwritten it. afaics his only hope is that he has it backed up somewhere.

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: George Papavgeris
Date: 24 Feb 10 - 10:08 AM

Hamish, it would depend on how large the new file is, compared to the overwritten one. If the 'old' file was bigger than the 'new' one, there will still be areas of the 'old' file that have not been physically compromised - just not accessible through normal means. Typically, overwriting a file with a 'blank' leaves still most of the old file's sectors untouched...

...until the newly 'freed' space gets taken up by some other file of course, or one does a 'defrag'.

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: Stilly River Sage
Date: 24 Feb 10 - 11:57 AM

If you've written over it and saved it then I'm afraid you're shit out of luck. Unlike Word, you can't set notepad to automatically make a backup file to open the backup and save your work.

System restore isn't supposed to alter data, so that option isn't open to you either.

Sorry.

SRS

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: Bernard
Date: 24 Feb 10 - 03:53 PM

Usually the original file isn't overwritten by the newly saved version. The operating system writes a new version of the file first, then marks the old version as deleted, giving the new file its name in the File Allocation Table or Master Record Table. This is how the drive becomes 'fragmented', as it cannot always find contiguous free space for subsequent file versions.

As long as there hasn't been any other disk activity there is an outside chance of using an undelete utility to retrieve it - but it's a long shot.

There used to be a utility called 'Knife' which the Police, amongst others, could use to find data thought to have been overwritten. It worked on the principle that the space between tracks (cylinders) still had 'print-through' of the adjacent cylinders for a while after new data had been written.

My guess is that utility has become less effective due to the higher track density as disk capacity increases.

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: Murray MacLeod
Date: 24 Feb 10 - 04:18 PM

thanks to everybody for their advice.

I will chalk this one up to experience, and try to be more careful in future.

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: VirginiaTam
Date: 24 Feb 10 - 04:29 PM

I have noticed if you bring up the file properties there is a tab titled previous versions.

This may get you to a previously backed up copy somewhere. Following is from the link on the Previous Versions tab from one of my saved notepad files. I have not tested it though.


What are previous versions?
Previous versions are either copies of files and folders created by Windows Backup or copies of files and folders that Windows automatically saves as part of a restore point. You can use previous versions to restore files and folders that you accidentally modified or deleted, or that were damaged. Depending on the type of file or folder, you can open, save to a different location, or restore a previous version.

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: Nick
Date: 24 Feb 10 - 05:52 PM

You could try the following

Get hold of a hex editor (google search for Neo should come up with an excellent freebie)

There are many things you can do with a hex editor but it's ability to search incredibly quickly across huge amounts of data for patterns is enormously useful.

If you can remember a phrase or something that might have been in the notepad file there is a tiny chance that you might find it somewhere on the disk. If you do you might then be able to copy it elsewhere (the free one doesn't allow it but you would at least know if it is recoverable)

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: Nick
Date: 24 Feb 10 - 06:51 PM

Here's something that suggests there MAY be some hope...

"Realize also that a "File Save" is rarely a direct write on top of the old file by the application. If that failed halfway through for any reason then you would have lost both old and new versions of the file. What's much more common is a sequence like this:

1.Write the new copy of the file to a temporary file
2.If that succeeds, then delete the old copy of the file
3.Rename the temporary file to the proper file name
As you can see, where the new file is written has nothing whatsoever to do with where the old file happened to be. To the file system they're just two different files."

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: Bernard
Date: 26 Feb 10 - 10:54 AM

I would suggest you don't try installing anything to search for the data, or you may end up overwriting the very data you're looking for!

Install it on a different machine and put your hard drive in a caddy, or run the software direct from a CD/floppy if that option is available.

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: Geoff the Duck
Date: 26 Feb 10 - 02:35 PM

Various file recovery programmes will download and install onto and run from a USB drive.
Quack!
GtD.

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: JohnInKansas
Date: 27 Feb 10 - 04:29 AM

To some extent, beginning with Win98, and increasingly so for WinXP, Win2K, and Vista, it requires an immense degree of manipulation by any Windows program to manipulate any hardware directly.

All "modern" Windows operating systems include a "protection layer" that passes everything from the processor to hardware devices, and the protections built in prohibit/prevent direct access to the hardware - such as the access needed to look at drive clusters directly. (By "hardware addresses" rather than by filenames.)

Some protections can be bypassed in Safe Mode(s) but there still is not necessarily a "clean" direct hardware access.

One of the main reasons many WinXP drivers can not be used in Vista is that WinXP allowed limited "protection layer bypass" so that some device drivers could talk directly to the hardware (drives, printers, scanners, etc.) but Vista incorporated a "stronger protection layer" so the conversation failed for any drivers that attempted to use direct device access.

Most programs intended for hardware manipulation should always be booted from a drive other than the Windows System Drive (usually C:\), and for many purposes they must boot to an operating system other than Windows. The "Command Prompt" that has replaced DOS in Windows may look the same, but is not really DOS and may not be able to run "old DOS" programs.

In olden times you could boot from a floppy (often to DOS), but the programs needed for the larger drives and bigger RAM on recent computers have outstripped floppy capacity (and floppies can only be formatted FAT8 (or is it FAT12?), which makes it difficult to run programs compatible with FAT32 and NTFS formatted hard drives.)

Obviously, partitioning an existing drive to add a new boot partition is likely to destroy much of the potentially recoverable information on the drive, and installing a new program on the drive is highly likely to obliterate what you want to recover.

You can boot from a CD, but for the processor to operate it must "see" only a program small enough to fit entirely in RAM unless it has a place to write temporary files. If it can't write to the boot device (as is the case if it/s a CD) it has to page memory on and off a hard drive, and if C:\ is all that's there you again risk obliterating at least some of the places where you might otherwise find what you're looking for.

To manipulate a large hard drive, the processor has to keep track of where it's looking, and the "memory paging" to traverse the drive one cluster at a time and keep track of where it is, where it's been, and what comes next can take a rather large amount of "paging temp" memory on a writable drive, which must be the one with the stuff you want to recover unless the "temporary" boot drive provides writable space that the processor recognizes as "temp space" it can use, or if the initial program "load" can direct it to use temp space on another drive - assuming another one is connected and is known at the time of program (OS) loading.

If a recovery is to be successful, the program also has to keep track of the hardware location (at least the cluster address) of every "empty" cluster that has bits written anywhere inside it.

Thus for a file recovery program, it is very much advised that you boot the recovery program and it's program-specific OS from a separate drive (or partition) with sufficient free writable space for the program to operate from the booting drive and to store and manipulate all the data it will transit during the recovery on that drive.

Older programs that suggested pre-installing on a separate partition used to suggest that the partition in which the program was installed should have at least half as much free space as the largest (in terms of free space) drive from which you might want to attempt to recover data. Efficiency probably has improved since then, but being generous with the space is probably better than coming up short.

As it's been quite a while since I've used one of these programs, there may be some new fairy snot or whiffle dust that does magic things with newer systems; but the above is my impression from some programs that used to do good recoveries.

John

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: GUEST
Date: 30 Nov 11 - 04:15 PM

fucking genius VirginiaTam it worked!!!! cheers mate

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: Joe Offer
Date: 30 Nov 11 - 06:15 PM

Virginia Tam, you're wonderful! I wish I had known that a couple of weeks ago when I overwrote a database I've kept since 1988. I found it on my backup drive, but your method would have been so much easier.

-Joe-

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: Stilly River Sage
Date: 01 Dec 11 - 10:41 AM

I had to poke around to find this - previous versions aren't viewable from within the opened notepad file tabs, but when you mouse over and right-click the unopened file. I'm looking at one I've worked on and it tells me there are no previous version available, but this is good to know. Thanks!

SRS

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: JohnInKansas
Date: 01 Dec 11 - 03:25 PM

In recent windows versions, Windows Explorer lets you look for previous versions quite conveniently. If you right-click on a filename, one of the options is "restore previous versions."

Note that the option apppears to be there regardless of whether there are any previous versions to restore, so it might not actually do anything useful; and Microsoft doesn't give any information that I've been able to find about whether the previous version(s) are restored as identifiable separate files or whether you have to pick one that will replace the existing current version. (It might matter?)

If you want to save the current version, but also want the recovered versions, you'd need to copy the new one elsewhere and rename it before you do the "restore" back at the original file location(?).

As has been noted several times above, when you save a file in which you've made changes, the new file is completely written in a new physical location on the hard drive in nearly all cases, so the old version is still on the drive. The old file is marked as "space available" by changing (deleting) the single "first byte" of the filename. The rest of the file remains on the drive until something else needs that space and overwrites it.

This also is of little help if you've accidentally deleted a file (without letting it go to the Recycle bin), since for a deleted file there's no filename displayed on which you can right-click.

With older Windows versions, file recovery (undelete) programs could physically access the hard drive to look for clusters containing information with "missing first characters" in order to get multiple older versions and deleted files back, if you could guess what character to put back for the first letter of the filename; but the hardware protection layer in more recent versions makes that "difficult." Rebooting from a non-Windows disk usually can be used to run a recovery program with the necessary hardware access, but good programs of that kind have become difficult to find.

Methods are claimed to exist for recovering hard drive information that has actually been overwritten. When a "bit" is changed on magnetic media, there are "fringes around the bit" that "remember" the change, so a weak bias field applied to the whole drive (very carefully) can exaggerate the "fringe fields" while knocking down the peaks, making some recovery sometimes possible. The method is more usable for things like audio tape recordings (remember the Watergate blather about "recovered minutes"?) Audio tapes are really sloppy, which helps. Hard drives are much "cleaner" so it's questionable how successful, even theoretically, any such process might be.

Belief in the existence of such methods is responsible for the requirement (DOD & elsewhere) that erasing a "sensitive" drive requires writing over all the empty spaces multiple times with different bit patterns before allowing the media "out of the vault." Of course our government(s) wouldn't want us to believe anything that isn't true, so ... we must believe "they" can do it, even if we can't.

John

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: McGrath of Harlow
Date: 01 Dec 11 - 05:14 PM

I don't seem to have this option come up when I right click, nor under properties. This is with Vista Home Premium.

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: JohnInKansas
Date: 01 Dec 11 - 06:23 PM

McG -

It may be affected by how you've set up Windows Explorer (that's not Internet Explorer).

In Classic View, folders view, you should have a folders tree in a column on the left, and files and folders in the folder that's selected on the left should be in a separate window with a group of columns on the right. You'll need to click to select the folder that contains the file of interest on the left.

If you next right click on a filename in the right column, you should get a drop-down with options:

Open
Edit
Open in Same Window
Print
Open With
Restore Previous Versions
(Mine also includes a click to scan for malware, but that's because of the AV I have.)

Separated below those, you should see several other options, like the Send To, Cut, Copy, Delete, Rename, etc., and File Properties at the bottom.

Additionally, if you right-click on the bar above the columns in the right side window, it will show you what you've selected to display in all the columns in the right window. Click "More" at the bottom of that list to get the approximately 128 different "column labels" you can use. (Some of the selections only apply to particular file types, but you can use this feature e.g. to see what kind of camera took the picture you just downloaded, if the EXIF data wasn't removed from the file before it was posted - or for a few other sneaky things.)

John

Subject: RE: Tech: Can I undo an overwritten Notepad file ?
From: GUEST
Date: 11 Feb 13 - 05:36 PM

Thanks, VirginiaTam - previous versions saved my bacon too.