Replace vs Rename dumb mistake

Help & Support
1

I was sorting 2 directories both with files that had the same name but saved on different days. I wanted to move them all into 1 directory and save ALL files. When I was warned that files had the same names I meant to select rename all new but instead clicked on replace by mistake. I immediately clicked UNDO which did get the moved files back to their original directory, but of course the over written files were gone.

My question is, is it worth trying to use an undelete file disk sector scanning program to retrieve the old files, or are they gone forever since they were over written,

Thanks

2

It's worth a try. The sooner the better, as every moment the machine is on is another that the unused disk space may be repurposed for new data.

3

But in case you overwrite a file, it's content is always gone or at least very much corrupt if the new file is less in size - or has that handling changed in the years for ntfs?

4

No, not necessarily. You're confusing opening a file and writing over its data, with deleting a file and creating a new one with the same name.

5

Thanks for the response.

Luckily this was on my secondary data drive, not my OS drive. One thing I failed to mention is that both directories where on the same drive, that makes things worse I bet.

Also, do you have a reconnendation on a good utility for this? I have not tried to do this in years.

Thanks again.

6

PMJI:
W7 has previous versions (right click) and W8 has file history to go back on, if enabled but also:
If you had System protection turned on for that drive (system properties, system protection), there is another possibility.

Open a command prompt as administrator:
Then run the command:
vssadmin list shadows
You will get a list of shadow copy sets and shadow copies. They have dates and will look something like this:
C:\Users\Administrator>vssadmin list shadows
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

Contents of shadow copy set ID: {6b1c04dc-5993-4e1f-9db2-2110938ecde6}
Contained 2 shadow copies at creation time: 8/1/2014 8:41:23 AM
Shadow Copy ID: {8d6dcd58-8e30-4ce5-ac84-a3218a10078f}
Original Volume: (E:)\?\Volume{2db94b57-43dd-11e3-8251-000c2974cdc6}
Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4
Originating Machine: W81Dev
Service Machine: W81Dev
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differentia
l, Auto recovered

  Shadow Copy ID: {43a0ef8e-17a4-46cf-9515-af671e1730fb}
     Original Volume: (C:)\\?\Volume{ce097b0c-43e7-11e3-824c-806e6f6e6963}\
     Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
     Originating Machine: W81Dev
     Service Machine: W81Dev
     Provider: 'Microsoft Software Shadow Copy provider 1.0'
     Type: ClientAccessibleWriters
     Attributes: Persistent, Client-accessible, No auto release, Differentia

l, Auto recovered

your numbers and names will be different. I was restoring files from a snapshot of the E drive.
so, I just put \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4 in DO's address box :sunglasses:

Only works if you had system protection turned on for that drive.

7

@leo
Yes, you're right. I did not think of the file being deleted before.

I may be wrong again, but in this case I wouldn't say it made things worse. If the old file just got deleted and the new file basically just renamed (which maps to a move on the same drive), than chances are quite high the data of the "overwritten" file were not touched at all, because I think moving a file on the same drive does not alter the filesystem structure much (because it's just changing name).

Good tools for recovering deleted files are R-Studio from R-Tools Technology and "Get Data back for NTFS", I was successful with these at least, but they are not free to download and use.