# Possibility to recover overwritten images on harddisk?



## Zulu (Dec 11, 2012)

Hello,
I'm new to the forum and have question.
I have a huge problem. About 2 years ago I bought an external drive to archive my photo portfolio older than 2010. I created a folder and moved all my photo's there. They were already be given proper names, something like 090806_photoshootModelX_sugarfactory_Miami.

I installed a backup program that periodically updated the folder with new files. But something went horribly wrong and I don't know how and when it happened. But the complete folder was overwritten with everything after 2010. So all the photo's prior to that are all gone, nearly 5 years of data is just gone. 

I tried several deep recovery programs and one them, Recuva, found all my 200.000 photo's. By name, date, even modified and all the meta data intact, witch the focal length, camera info and lens used is all there. I plugged in a second hard-drive to recover them but none of them are actually recovered. The files are empty. 

Looking back at the recovery info it states that the file are overwritten by newer files and the recovery might not succeed.

Does anyone have a similar experience in this? How did you get your files back?
Is there any program that exist in 2012 that can somehow recover some or all of the data? Even if it scrambled I can live that.


----------



## Paul_B (Dec 11, 2012)

I have experience with recovering lost files and "overwritten" is basically the dead-sentence for your files.
What you saw is information from the file system (sometimes referred to as "slack space") that was not yet overwritten (as it is in a different location on the disk than the actual file data).
You can employ a professional company to try to recover your data. I have heard things about magnetic properties of disks that allow you to recover data after it is written over (not numerous times) but you are in the forensic territory there, sorry to say.


----------



## nameless (Dec 11, 2012)

If none of the programs worked, and the programs actually did a deep drive scan (which takes probably hours), then you can't do anything. A file-recovery is successful, when you do it right after you deleted (including replacing) the file. If you wait too long (which you probably did), then the drive uses the sectors again and overwrites the data.



Paul_B said:


> You can employ a professional company to try to recover your data. I have heard things about magnetic properties of disks that allow you to recover data after it is written over (not numerous times) but you are in the forensic territory there, sorry to say.



That is actually possible, but will cost you probably a few 1000$ per Gigabyte and you don't even know, if they recovery anything useful.

I'm sorry to say than, but your files are probably lost.


----------



## Marsu42 (Dec 11, 2012)

Zulu said:


> Looking back at the recovery info it states that the file are overwritten by newer files and the recovery might not succeed. Does anyone have a similar experience in this? How did you get your files back?



Sorry to say, you probably don't, at least not the full files. You could try my favorite http://www.r-studio.com/ but still, it is likely only the names are found but point to overwritten data. At least this software has support for digital camera raw images from Canon.

If there are *parts* of the images that weren't overwritten you could extract them, but if the file header is lost you need expert knowledge to reconstruct some part of the image or some other software except r-studio I'm not aware of. Jpeg files are constructed in a way that if for example the start or end is lost you could still recover part of the picture and that's probably better than nothing. So don't give up yet, there might be some software solution after all, at least sooner or later.

The other option for really overwritten data is to employ military/enterprise grade forensic data recovery, but as stated that costs you way beyond what you could imagine, so that probably is out of the question.


----------



## M.ST (Dec 11, 2012)

If the files (sectors on the harddisc) are overwritten, then you have no chance to get the files back.

Don´t try to recover the files with a file recovering software yourself. Don´t write another file to the harddisc. 

Use a professional service like http://www.datarecovery.com/ for recovering the files. You have to send in your harddisc.

A file recovery service is expensive. You have to decide, if the lost images are worth to try an expensive recovery.

For the future: Use a SAN to save your images or if you don´t have the money for a SAN save the images on two or threee harddiscs and make backups on DVD or Bluray.


----------



## Marsu42 (Dec 11, 2012)

M.ST said:


> Don´t try to recover the files with a file recovering software.



I disagree, afaik it doesn't hurt to try at just reading the data - but the most secure option if in doubt is to create a full sector image of the hd (throught r-studio or some backup software like acronis), then mount the image and work on that.



M.ST said:


> Don´t write another file to the harddisc.



That's a given


----------



## fr8oc (Dec 11, 2012)

I've used this company for data recovery a couple of times for work. They were successful both times recovering the data. 

You send them the disk and for a fee they will let give you a file listing that they can recover. They will then quote how much they will charge for recovering the files. As others have said, it's not cheap. I would definitely call and tell them your situation to see what they recommend.

http://www.krollontrack.com/


----------



## bycostello (Dec 11, 2012)

data recovery companies are very expensive.. make sure u really need the files!!


----------



## PeterJ (Dec 11, 2012)

Be aware too of 'snake oil' in the data recovery business too. Maybe someone can prove me wrong but I'm not aware of a single case ever with a modern HDD where data has ever been recovered by anyone if the actual data has been overwritten even once.

That's a lot different to an 'oops' moment where you realise soon after you've deleted the file so it's flagged as deleted but the orignal data is still on the disk. I guess being a backup drive it was pretty full and has had plenty of writes over the data, so based on your results from those tools unfotunately suspect you'll be out of luck.


----------



## EvilTed (Dec 11, 2012)

I'm sorry you've lost all your stuff, it's happened to me in the past too 

On the question of recovery, it depends.

When files are "overwritten" not all the blocks may be hit.
It also depends upon how many times they have been "overwritten".
If you are using a Mac, Prosoft have a program called Data Rescue, which I've used with "some success" in the past.
I see they have a PC version, but I've never used it.

http://www.prosofteng.com/products/

I work for the largest storage company in the world, so backup and retention is my thing.
We have a rule of "3 copies, with one of them offsite" in the industry.
I'm not suggesting you need the level of protection that I use, but I don't want to lose my photos, music or documents, so I follow that mantra at home too

All my Macs have shares to a QNAP NAS which runs on my network 24/7.
It has 8x 2TB Enterprise drives running in RAID 6.
This automatically backs up to the Cloud using CrashPlan+, direct from the NAS.
I also have a Dell Server that has a hardware RAID controller and external enclosure with 8x 1.5TB in RAID 5, used once a month as an Rsync backup from the QNAP.

This way, worst case, I still have a copy on CrashPlan's servers in the Cloud that I can recover if absolutely necessary.
CrashPlan+ is very cheap, has unlimited storage (I currently store 2.1TB) for $50 a year and more importantly, they don't throttle you after a certain data size.

HTH

ET


----------



## Marsu42 (Dec 11, 2012)

PeterJ said:


> Maybe someone can prove me wrong but I'm not aware of a single case ever with a modern HDD where data has ever been recovered by anyone if the actual data has been overwritten even once.



I just did some research and you seem to be correct - on modern disks (like 10+ years modern ) overwritten data list lost since the writing tech has changed so much since the good ol' days. If there is any possibility, it is well out of reach of private citizens and you have to ask your trusty nsa or equivalent for help.


----------



## RustyTheGeek (Dec 15, 2012)

Marsu42 said:


> PeterJ said:
> 
> 
> > Maybe someone can prove me wrong but I'm not aware of a single case ever with a modern HDD where data has ever been recovered by anyone if the actual data has been overwritten even once.
> ...


*Don't mess with the drive any further if you want to recover anything.* Turn it off. Professional Data Recovery is not only possible, it happens all the time. Reputable and Skilled companies do exist. Try the company below. I've known them personally for 10+ years since they are local. I've used them several times for clients with great success. They will be honest with you and tell you not to bother if they really don't think it's worth the money it will cost. They won't charge you until the work is done but they do charge an initial estimate fee that can apply to the recovery if it's deemed feasible.

*http://www.tlsi.net/ - Call and talk to Eddie, he's the owner. Good Luck.*


----------



## melodygong (Dec 15, 2012)

I afriad that your data can't be recover any more.

If you have not write any data into hard disk before, you can use the link below to retrieve lost photo:

http://www.any-data-recovery.com/topics/photo/retrieve-photos.html


----------



## markwilliams279 (Jan 29, 2013)

It is not possible to recover images if you have overwritten on hard disk.


----------



## colin1984 (Feb 6, 2013)

If your data Recovery don´t get anything working, than no one will be possible to find something usefull, overwrite is overwrite, maybe you find some Photos, maybe u can recover them but it can happen that you don´t get the full Picture only a piece of it, 

For future I can also recommend two or three hdd´s,

I bought myself a Ready NAS, Which runs in X-Raid2 because both of my hdd´s were erased like if you get it new and don´t know why, I restored als my data transferred it to the Nas wher one Hdd mirrors the other

For me it works fine, use it with lightroom, altough you can´t make a db file on nas, that is storaged on my Computer, but Lightroom works fine with it, as far as the pictures are Imported, Importing pictures via Wireless Lan takes a Little time 200 pictures aproximately 1 hour but directly over Lan it works perfect and as fast as usb 
*Please note I said as fast as USB*


----------



## Marsu42 (Feb 6, 2013)

colin1984 said:


> I bought myself a Ready NAS, Which runs in X-Raid2 because both of my hdd´s were erased like if you get it new and don´t know why, I restored als my data transferred it to the Nas wher one Hdd mirrors the other



This tread is very old, but before anyone believes that using nas/raid for data safety: It does protect you from *hardware* failure, but it doesn't from *software* or *user* error. If you accidentally erase some folders of files (most common disaster cause) a raid setup won't protect you, only an independent backup will. So raid is for high availability, but not necessarily for data safety.


----------



## kaihp (Feb 20, 2013)

Marsu42 said:


> colin1984 said:
> 
> 
> > I bought myself a Ready NAS, Which runs in X-Raid2 because both of my hdd´s were erased like if you get it new and don´t know why, I restored als my data transferred it to the Nas wher one Hdd mirrors the other
> ...


Agreed.

Repeat after me: having a RAID disk is not a replacement for making backups! They're really orthogonal issues.


----------



## WillThompson (Feb 20, 2013)

allenmafatoo said:


> It is possible to recover the overwritten files.



NO! It is not possible to recover overwritten files! This is fact! You can restore them from a backup only! What you can recover are files where the file allocation table hase been overwritten, erased, deleted, or corrupted but the actual file data has not been changed. The best example of this is when the file has been deleted.

Will T.


----------



## markwilliams279 (Mar 19, 2013)

It is not possible to recover the overwritten images from the Hard disk.


----------



## alexanderferdinand (Mar 22, 2013)

Overwritten can mean: 
new files taking their places, so they are gone.
or:
only "this place is free and usable"
then you have a chance.
(You never now if the new files are on the same place physically....)

Anyway: when youre not sure, let one of the recommended porgrams look for them.

Good luck!


----------



## RGF (Jun 17, 2013)

Paul_B said:


> I have experience with recovering lost files and "overwritten" is basically the dead-sentence for your files.
> What you saw is information from the file system (sometimes referred to as "slack space") that was not yet overwritten (as it is in a different location on the disk than the actual file data).
> You can employ a professional company to try to recover your data. I have heard things about magnetic properties of disks that allow you to recover data after it is written over (not numerous times) but you are in the forensic territory there, sorry to say.



As Paul points out, lost files where the directory structure is overwritten is recoverable. If the data is overwritten, unless you are willing to go into the area CIA and FBI advanced data recovery, forget it. Once the data itself is overwritten, you are unfortunately SOL.


----------



## RGF (Jun 18, 2013)

kaihp said:


> Marsu42 said:
> 
> 
> > colin1984 said:
> ...



Yea - you want to protect yourself from hard failure (raid can do that to a degree), user stupidity (independent backups help here, though nothing helps against true stupidity), and site loss (need to keep independent backups up to date and off site).


----------

