We are committed to providing fast, efficient, and affordable software solutions that set new standards in the software development industry.
  • Recovery of Overwritten Data

Quite often our customers ask us if it's possible to recover overwritten data and if so, then how would one go about performing such a task.

First let's take a look at how data is stored on a data storage device. There are currently two main types of storage devices: conventional hard disk drives (HDD) and the newer solid-state drives (SSD).

Hard Disk Drives:
HDDs use magnetic storage to store and retrieve data. Their heads magnetize a thin magnetic film on rotating platters. Changes in the direction of magnetization represent 0's and 1's in stored data. When a new data is written over the old one, the direction of magnetization is changed according to the new data, and there's no way to retrieve the previous data, at least without completely disassembling the disk and analyzing the magnetic field on its platters scrupulously. All of this is beyond the skill of even a very advanced computer user.

Solid State Drives:
SSDs use another physical principle for data storage: they store electrical charges within their internal cells. Before new data can be written to a cell, it has to be discharged which means that the previous data is lost. To make the situation even more complicated, SSDs utilize a complex method for deleting and writing. You may read more about file recovery from SSD devices in our article: File Recovery Specifics for SSD devices

Although these two storage devices are different in their operating principles, they have one thing in common: once data is overwritten, it's gone. Forever.

Now let's look at how all this affects file recovery.

An overwritten file
All modern file systems store the information about the file, such as its name, timestamps, and other service info separately from its content. There are several reasons for doing it this way, flexible free space management being the main. In addition, a file may be stored in fragments for better free space utilization. Fig.1 shows a typical file storage layout on a disk:
file storage layout
Figure 1: File storage layout
Click image to enlarge

When a contemporary operating system deletes a file, it partially or completely deletes the info about the file, but the content of the file remains intact. The file can therefore be recovered even when its info is completely deleted, provided that the file is not fragmented.

If the file is overwritten, the new data overwrites the old one, such a file cannot be recovered. The new file may have the same name and size, but the content will be new. This is how file wiping programs (such as our R-Wipe & Clean and Shredder in R-Undelete) completely destroys files beyond any recovery.

An overwritten partition
An important note: Do not confuse this case with reformatted partitions, where only the info regarding files and folders is lost, whereas the content of the files remains untouched and can be recovered to some degree.

When an entire partition gets overwritten, for example, when a new operating system is installed on the wrong partition, or an image is wrongly restored, the data of the new partition overwrites the data of the previous one. Fig. 2 shows such a case.
Overwritten partition layout
Figure 2: Overwritten partition layout
Click image to enlarge

Almost always such process completely overwrites file info but may keep some data from the previous partition untouched. Some files may be recovered from the untouched area using search for known files (raw file recovery). Our article File Recovery after Re-installing Windows (Case 1. New Windows has been installed on the same and one partition on the disk) presents an example of such a recovery. (You don't have to use always R-Studio Emergency for such recovery, if you're going to recover files from an external disk, R-Studio for Windows/Mac/Linux will do the same job more conveniently)

Data Recovery Feedback
370 feedbacks
Rating: 4.8 / 5
I really love your R-Studio product, I am doing Data Recovery as a professional, I used RS since the early versions and I loved the product, as far as I can tell, R-Studio, especially the Tech Version (but including the standard) is one of the best and excellent tools for a pro to have in the arsenal of tools in a pro DR lab, especially combining with the specialized Data Recovery hardware providers like DeepSpar, and PC3000, the rest of `wannabees` out there are waste of time, strongly recommend
I lost more than 200K files from my NAS due to a mistake. I tried 3 different recovery solutions over the 4 TB raid disks, and all of them performed ok but to be honest none of them were able to Raw recover the files and rename them with meaningful names out of the Metadata like R-TT did, then I was able to sort again my files and pictures and kind of restore all of them.

R-TT may not be the easiest or most user-friendly solution, but the algorithm used for the renaming saved me THOUSAND of hours of opening ...
Just recovered my old ext4 partition with R-Studio after trying testdisk and R-Linux without success. That partition was overwritten by another ext4 partition and I was losing my hope until I tried R-Studio demo. It detected all my files and directories again!

Bought it and 100% recommend it for anyone with a similar issue.
Genuinely tried every free program available without luck of recovering a deleted file from months ago. Thinking my file was deleted forever and lose all hope I came across this website as a recommendation.

I was reluctant as it seemed pricey compared to other programs, but damn worth every penny. It managed to even find files I thought were wiped from existence.

Kudos to r-tools, thank you!
Why make incremental backups, when there is R-Studio?

I`m an IT professional who has worked from home for over a decade. Early on in my career, I configured an HP ProLiant Server (Raid 1+0) as a workstation that I would remote into from my laptop. As technology evolved, I began to use it only for email and as a config file repository.

A short while ago, one of the drives degraded, but the HP ProLiant Server (Raid 1+0) still functioned fine on the remaining drive. I was complacent and didn`t replace the ...