April 24, 2010

Restoring file content

I bought Asus PC eee 701 for my mom(her first computer) for writing, someone deleted her file

content and then she over wrote with new text but she really needs the original text back, is it   

possible any way, shape or form?                                                       

If you don't mind using command line applications, you might want to check...

If you don't mind using command line applications, you might want to check out a piece of software called Foremost. It was originally developed by the Air Force Office of Special Investigations to recover deleted files, and should provide you with the means to do something similar to an FBI Forensics lab.

Beware that using this software to recover data takes a lot of time. First, the program will have to scan through an entire partition to look for known file formats. And after that, since the software recovers file contents but not filenames, you have to figure out exactly which of the discovered files you were looking for.

Also, don't forget that there is always a chance the computer might have overwritten some of the file data on disk; so the original file might be partially or completely corrupt.

The software is available here:
http://foremost.sourceforge.net/

Like  (0 likes)

In what application was she writing her text? And on what type of file system...

In what application was she writing her text? And on what type of file system was the file stored?

As GoinEasy9 pointed out, you might be able to recover a backup file. Knowing what application was being used would help identify if that was a posibility. Also, knowing what file system was in use, and how big the original file system was, and the size of the new file may help in that FBI style forensics that he mentioned. It's posible that the deleted file is still on the drive, and that it was just unlinked from the file system, so you may still be able to recover the text, if you know what you are looking for using a hex editor and a lot of patience.

What may be even better at this point, is to use the this as a learning opportunity to teach your mom the vlue of backing up important data. ;)

Like  (0 likes)

Your only hope is if there is a backup file. You can look in her /home...

Your only hope is if there is a backup file. You can look in her /home directory or possibly her /home//Documents directory and see if those files exist. In your file browser menu, go to View-->Show hidden files because sometimes backup files aren't shown but are hidden.
If you don't see backup files, and the original files are overwritten, it would take an FBI Forensics lab to pull them back.

Like  (0 likes)