Recuva won't let me overwrite a file, it says "overwritten" but it's recoverable

[CloudCrateJupiter]

Sometimes Secure Overwrite works and when I try to Recover Highlighted after, it's unrecoverable (as it should be).

However sometimes it doesn't work. Certain files I want gone forever are marked as Unrecoverable and "This file is overwritten with", but when I choose to recover them with Recover Highlighted, they still get recovered. This shouldn't be happening. When I try to Secure Overwrite the "This file is overwritten with" file again, Recuva won't let me and gives me the message "File is already overwritten by existing file(s)".

I need these specific files gone, how can I fix this?

Edited April 24, 2020 by CloudCrateJupiter

[Augeas]

Recuva is working fine. Overwritten by another file means that the deleted file's clusters have been reused by another live file. You can 'recover' the original file as a recovery is simply copying what's in the file's clusters. What you will get however is the data from the overwriting file, the original data has gone forever. You cannot overwrite an overwritten file as you would be overwriting the data from the new file, which is not what you want to do.

[CloudCrateJupiter]

On 24/04/2020 at 04:22, Augeas said:

Recuva is working fine. Overwritten by another file means that the deleted file's clusters have been reused by another live file. You can 'recover' the original file as a recovery is simply copying what's in the file's clusters. What you will get however is the data from the overwriting file, the original data has gone forever. You cannot overwrite an overwritten file as you would be overwriting the data from the new file, which is not what you want to do.

Hi Augeas, thanks for your reply! I don't think I explained it properly. I'm trying to Secure Overwrite a png image.

• If Recuva worked, when I recover the Overwritten image with Recover Highlighted: it should be an unreadable file with the original data gone even if it's recovered.
• What's happening is when I recover the Overwritten image with Recover Highlighted: it recovers the image completely intact with all its visuals and original data.

I don't know why the initial Secure Overwrite didn't work as the png image is recoverable with all original visual data, instead of an unreadable file with replaced data. Any way I can fix this?

Thanks! Looking forward to your reply

[Augeas]

The entry for the deleted file in the Master File Table contains the addresses of the clusters it used. If these clusters have been reused then another live file is using them - they have been overwritten. The cluster addresses in both the deleted file and the live file point to the same clusters  If you recover an overwritten file you will be recovering (copying) what's in the live file. the data from the deleted file has gone forever. You cannot secure overwrite the deleted file's clusters because they are being used by the live file. Recuva is working fine, this is how NTFS works.

[CloudCrateJupiter]

I think I understand, so the live file is elsewhere and keeping the deleted data alive? I need to find it and secure overwrite it?

[Augeas]

Please re-read my posts, perhaps a little slower.

[CloudCrateJupiter]

Sorry for my confusion, I really appreciate your patience. I'm not the most tech savy person but I think it means the deleted and live file share the same clusters, so recovering it brings up the overwritten live file which has none of the deleted files data. That data is gone for good.

My issue is, why is the deleted image data still intact if it's been overwritten and gone for good?

• I select 'Recover Checked'
  
   
• I choose to recover it in a folder
  
  
  
   
• It's recovered with all its original image data is still there, the same as it was before the Secure Overwrite.
  

I'm not sure what my next steps should be as the deleted data should be gone forever even though it isn't? Thanks so much for bearing with my limited computer knowledge as I try to learn.

 

 

[Augeas]

It appears that the deleted file is called sandvich.png somewhere in c:\users. The overwriting file is also called sandvich.png in c:\users. If you follow the path of the overwriting file you will find a live copy of sandvich.png. As the deleted file and the overwriting file are both the same image then when you recover the deleted file you will get the live file's contents. This has caused the confusion. I don't know if you want to get rid of sandvich, but if you do then delete the live copy. You will then be able to overwrite your deleted file.

This may have been caused by sandvich being deleted and then recreated more or less immediately afterwards. The new allocation has used a different record in the Master File Table to write the file name etc, but the same clusters have been used to hold the new file. Thus the live file and the deleted file entries in the MFT point to the same clusters, and co-incidentally it is the same image as before.