Will overwriting a temp file overwrite the actual file?

[Cliffmeister]

I originally used Recuva on my personal laptop to try and find and recover another totally unrelated Word document I'd lost when the first thing that popped up at the very top of the list of filenames listed by Recuva was a temp file that is deeply concerning to me because of the date it shows and because I don't know how that temp file or its date came into being in the first place or how it got deleted. Maybe the explanation's clear to someone like you with computer expertise, because I'm no expert, quite the opposite. For all things computer I must use Google and YouTube to try and fumble my way through, often with limited to no success, so any expertise, help, you might give me please would be GREATLY appreciated.

Anyway...

When I run Recuva on my C:, I get the following deleted temp file as the very first result because the results are in reverse chronological order and this' date is the most recent:

• File name: ~$Ben.docx
• Path: C:\Ben\ 
• Last Modified: 1/28/2024 11:12
• Size: 162 bytes
• State: Excellent
• Comment: No overwritten clusters detected

The actual undeleted file has the following properties:

• File name: Ben.docx
• Path: C:\Ben\
• Last Modified: 1/30/2019 3:57:58 PM
• Size 24,576 bytes

I think 1/28/2024 at 11:12am might've been the last time I looked at it, and not even in Word but using File Explorer's preview pane. That's because I make a point to NEVER open this file in Word so that autosave or whatever doesn't mess up the dates shown in its properties. That's because this file is part of a highly politicized intra-office dispute and the dates in its properties prove I actually did do something quite critical that a systems coordinator, who's been gunning for me ever since I got promoted to assistant manager instead of him, says I failed to do and, I believe, erased the evidence on the systems at work of my having done it. But I have this proof on my personal laptop, which he has no access to, that I actually did do it. Only now, if he demands to examine this evidence, which I could hardly deny letting him without looking guilty, especially since I've already offered to let him to my bass, with his high level of computer knowledge and with the various tools at his disposal, he'll certainly find that deleted temp file ~$Ben.docx with that date last modified of 1/28/24 and try and make it look like it proves my file Ben.docx is somehow bogus, like I created or changed Ben.docx on 1/28/2024 and then tried to cover my tracks by deleting the temporary file and doctoring the dates on Ben.docx, which I don't even know if it's possible to do that or, if so, do that without there being loads of proof of it in logs or whatever, but he'll make it seem so.

Anyway, I'm tempted to nip that in the bud by just cleaning this mysteriously appearing temp file ~$Ben.docx off my C: drive using Recuva by overwriting it since it says the clusters it's on aren't overwritten with anything, but I'm not computer savvy enough, or really computer savvy at all, as I've said and as I'm sure would've been obvious to you even if I hadn't, to know if that'll overwrite or affect the file Ben.docx in any way, because that's my only proof I'm right, so I need it intact, unaltered. SO...

Will using Recuva to overwrite the temp file ~$Ben.docx overwrite, destroy, alter, or in any way affect file Ben.docx? If so, how do I clean the deleted recoverable file ~$Ben.docx and any trace of it, including its name, from my C:? Like is there a way to physically move the file Ben.docx to a different physical location such that it's stored in different clusters or sector on the hard drive on the hard drive without changing any of its metadata in order to enable this? And will overwriting ~$Ben.docx remove the name itself? I ask that last one because I've seen some things on this forum as I've looked for the answer to this question that overwriting makes the data unrecoverable but leaves the file name, not that it's very important that a temp file ever existed if there's no dates on it.

 

[nukecad]

If you look at the sizes of the 2 files then you can see that the "$" file is a tiny fraction of the size of the actual file. (0.006%).

So obviously it cannot contain the contents of that file.

A $ prefix usually indicates a temporary file that contains a record of changes made to a main file since that main file was opened.
Once the file is saved again those changes get written to the main file, and a new $ file created for further changes.
If no changes have been made then there is nothing to write.

If you want more peace of mind then go ahead and recover that $Ben.docx so that you can open it and see exactly what it contains.

If this files is as sensitive as you say to a works dispute then I have to ask if you really think it a good idea to have it or even access it on a works computer?
If it's on your personal computer then your collegue has no right whatsover to access that, and you should not allow him to.