Repairing Microsoft PowerPoint Documents, after Secure Overwrite

Recuva
1

Hi Everyone,

I did a secure a secure overwrite on a document which I had deleted, and when I rescanned the same document came up, but Recuva said that the state is 'excellent', and that no overwritten clusters have been found. The info showed the first 128 bits at all zeros, though this later changed to various characters after the file apparently had been overwritten with other data from the computer, and the state now says 'poor' and that the file has been overwritten by another. At each phase I could recover the file, but on attempting to open it PowerPoint has every time said that there was a problem with the content, and an error accessing the file. I'm simply asking - does this mean that the file is truly unrecoverable, or could it be restored?

Thanks

Matt

2

Nothing is truly unrecoverable. However, within the realm of your question, yes it is unrecoverable.

3

It is of course very possible that what Recuva found was NOT the document that you securely deleted,

but either :-

an earlier version that became discarded / replaced when you updated / revised it with an editor etc.;

or a temporary backup copy that was automatically created when by any editor or software package that was used for creating that document.

The info showed the first 128 bits at all zeros, though this later changed to various characters

That suggests to me that your document may have been held on the system drive C:\.

If so the instant it became part of "Free Space" its sectors were immediately available for the Operating System to re-use,

and the previous contents would be changed again and again.

4

Thanks guys - That makes things a bit clearer.