LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   File Overwrite Recovery (https://www.linuxquestions.org/questions/linux-newbie-8/file-overwrite-recovery-868618/)

Fracker 03-15-2011 12:02 AM

File Overwrite Recovery
 
Can I recover the file which has been overwritten.

Telengard 03-15-2011 01:22 AM

Usually this is not possible. Even so, the documentation of the shred utility seems to leave room for hope. I don't know how it could be done.

http://www.linuxcommand.org/man_pages/shred1.html

Quote:

Overwrite the specified FILE(s) repeatedly, in order to make it harder for even very expensive hardware probing to recover the data.
To me this suggests that very expensive hardware probing could recover data which has been overwritten. I don't know what exactly that means though.

chrism01 03-15-2011 01:25 AM

If you stop using the partition asap, you may get some stuff back. There are multiple threads here about that. iirc, photorec is one of the recommended tools.

Telengard 03-15-2011 01:42 AM

Quote:

Originally Posted by chrism01 (Post 4291102)
If you stop using the partition asap, you may get some stuff back. There are multiple threads here about that. iirc, photorec is one of the recommended tools.

Can photorec recover overwritten data?

Telengard 03-15-2011 02:12 AM

http://en.wikipedia.org/wiki/Data_re...erwritten_data

Fracker 03-15-2011 05:20 AM

ok Thanks guyz for the answer, i just wanna confirm, what should i use to recover files like 1_????_705102936_arc which are only erased, not overwritten.

Meanwhile we are working on recovering the required file.

tuxandpucks 03-15-2011 06:20 AM

Try testdisk or recuva to recover your data. They both work well for me. Good Luck.

chrism01 03-15-2011 07:47 PM

@Telengard; depends whether it's been truly/literally physically overwritten ie at the disk block level (unusual unless you go out of your way to achieve it) or whether it's just eg in the same dir. The latter wouldn't necessarily mean an actual overwrite.


All times are GMT -5. The time now is 08:59 AM.