The Mudcat Café TM
Thread #127607   Message #3266887
Posted By: JohnInKansas
01-Dec-11 - 03:25 PM
Thread Name: Tech: Can I undo an overwritten Notepad file ?
Subject: RE: Tech: Can I undo an overwritten Notepad file ?
In recent windows versions, Windows Explorer lets you look for previous versions quite conveniently. If you right-click on a filename, one of the options is "restore previous versions."

Note that the option apppears to be there regardless of whether there are any previous versions to restore, so it might not actually do anything useful; and Microsoft doesn't give any information that I've been able to find about whether the previous version(s) are restored as identifiable separate files or whether you have to pick one that will replace the existing current version. (It might matter?)

If you want to save the current version, but also want the recovered versions, you'd need to copy the new one elsewhere and rename it before you do the "restore" back at the original file location(?).

As has been noted several times above, when you save a file in which you've made changes, the new file is completely written in a new physical location on the hard drive in nearly all cases, so the old version is still on the drive. The old file is marked as "space available" by changing (deleting) the single "first byte" of the filename. The rest of the file remains on the drive until something else needs that space and overwrites it.

This also is of little help if you've accidentally deleted a file (without letting it go to the Recycle bin), since for a deleted file there's no filename displayed on which you can right-click.

With older Windows versions, file recovery (undelete) programs could physically access the hard drive to look for clusters containing information with "missing first characters" in order to get multiple older versions and deleted files back, if you could guess what character to put back for the first letter of the filename; but the hardware protection layer in more recent versions makes that "difficult." Rebooting from a non-Windows disk usually can be used to run a recovery program with the necessary hardware access, but good programs of that kind have become difficult to find.

Methods are claimed to exist for recovering hard drive information that has actually been overwritten. When a "bit" is changed on magnetic media, there are "fringes around the bit" that "remember" the change, so a weak bias field applied to the whole drive (very carefully) can exaggerate the "fringe fields" while knocking down the peaks, making some recovery sometimes possible. The method is more usable for things like audio tape recordings (remember the Watergate blather about "recovered minutes"?) Audio tapes are really sloppy, which helps. Hard drives are much "cleaner" so it's questionable how successful, even theoretically, any such process might be.

Belief in the existence of such methods is responsible for the requirement (DOD & elsewhere) that erasing a "sensitive" drive requires writing over all the empty spaces multiple times with different bit patterns before allowing the media "out of the vault." Of course our government(s) wouldn't want us to believe anything that isn't true, so ... we must believe "they" can do it, even if we can't.

John