Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Must retrieve consecutively scanned files that overwrote each other

22 Jul 2014   #1
Halbfin

Windows 7 Home Premium 64-bit
 
 
Must retrieve consecutively scanned files that overwrote each other

Hello,

I scanned two files using a (newly acquired) Kodak i2900 document scanner, and was rushing. I saved both under the same (automatic) name in the same folder, and it didn't ask for overwrite confirmation. But it did overwrite the first statement.

I ran a search for all files modified at the time of scanning--They are all within one minute of each other. In order, I have:
  1. Prefetch file (LEXEXE.EXE) from system Prefetch folder
  2. PF file (LEXEXE.EXE) from system Prefetch folder (different hex tag)
  3. Log from scanner software's Program Data folder
  4. XML file in scanner software's Program Data folder (different subfolder)
  5. PF file (LEXEXE.EXE) from system Prefetch folder (all new hex tag)
  6. PF file (LEXEXE.EXE) from system Prefetch folder (yet another hex tag)
  7. PF file (TWAINGUI.EXE) from system Prefetch folder
  8. Shortcut to file name (a PDF document)
  9. Shortcut to file name (exactly same as #8)
  10. Shortcut to folder where I saved files
  11. Ditto #10
  12. PF file (KSSCFG.EXE) from system Prefetch folder
  13. Log, as in #3
  14. PF file (DLLHOST.EXE) from system folder
  15. HST file from scanner software's Program Data folder
  16. XML, as in #4
  17. PDF document using the name I changed it to about 2 hours later
  18. Ditto #17
  19. Extensionless {} file from a folder regarding malware
Can anyone please, please, PLEASE help me retrieve the first file?


Can I use some sort of forensic technique to pull data from the prefetch files? The target files are PDFs; I use PDF-XChange Editor. Others in the office have Adobe Pro. The scanner program didn't open up the files, though.



I also wonder if it's still somewhere in the scanner, which automatically turned off after a certain amount of time.



My system is a Dell XPS 8700 running Windows 7 Home Premium 64-bit, with 8 GB RAM, Intel i7 @ 3.4 GHz.



This is . . . really bad for me if I can't retrieve it. I would be VERY grateful for any help in this area!!! (Right now I am in a panic.)


Thank you!


My System SpecsSystem Spec
.
22 Jul 2014   #2
Berton

Windows 7 Ultimate 64-bit, Windows 8.1 64-bit, Mac OS X 10.10, Linux Mint 17, Windows 10 Pro TP
 
 

Unfortunately, once a file has been saved with the same name as an earlier file the earlier data is no longer available in most programs. Two files of the exact same name cannot be in the same Folder, one has to be at least one character different, the time, date, size, etc., don't make a difference, that has been a 'standard' for years, at least back to the late '80s when I started learning about computers for work and got my first computer in '92. Some programs may be able to retrieve a previous version but don't think so with scanning.
My System SpecsSystem Spec
22 Jul 2014   #3
Ztruker

Windows 10 Pro X64
 
 

Can't you re-scan them?

You can try Recuva but no way to know if it will find the overlayed one or not.
My System SpecsSystem Spec
.

22 Jul 2014   #4
Halbfin

Windows 7 Home Premium 64-bit
 
 

Quote   Quote: Originally Posted by Ztruker View Post
Can't you re-scan them?
No, that is one of my big problems. I don't have access to the originals.

Quote   Quote: Originally Posted by Ztruker View Post
You can try Recuva but no way to know if it will find the overlayed one or not.
Yes, I'm going to look into that and similar programs. When I made the above post I was panicking and figured I didn't want to install anything for fear of overwriting the unallocated space that used to be the file; a calm friend later pointed out that many file recovery programs can be run from a live CD and my computer wrote plenty to unallocated space just by visiting this website. I'm on a different computer now and can research a bootable recovery program.

Thank you both for replying. Berton, I'm quite aware of this restriction. I was hoping that it left breadcrumbs somewhere from when it originally created the PDF, like in the prefetch files.
My System SpecsSystem Spec
22 Jul 2014   #5
LMiller7

Windows 7 Pro 64 bit
 
 

Prefetch files contain instructions to more optimally load applications. They do not contain any portion of the files themselves.
My System SpecsSystem Spec
23 Jul 2014   #6
Ztruker

Windows 10 Pro X64
 
 

Quote   Quote: Originally Posted by LMiller7 View Post
Prefetch files contain instructions to more optimally load applications. They do not contain any portion of the files themselves.
This made me curious so I searched and found this: What is the prefetch folder?

What is the prefetch folder?

Each time you turn on your computer, Windows keeps track of the way your computer starts and which programs you commonly open. Windows saves this information as a number of small files in the prefetch folder. The next time you turn on your computer, Windows refers to these files to help speed the start process.

The prefetch folder is a subfolder of the Windows system folder. The prefetch folder is self-maintaining, and there's no need to delete it or empty its contents. If you empty the folder, Windows and your programs will take longer to open the next time you turn on your computer.
My System SpecsSystem Spec
23 Jul 2014   #7
Halbfin

Windows 7 Home Premium 64-bit
 
 

I thank everyone who replied. It's good to know more about prefetch files, even if it doesn't help in this instance.

I'm going to mark this as resolved, even though the file was not recovered. After a night of research and contacting some people motivated by money, the conclusion is that the file isn't recoverable. Fortunately I have a great boss, so I'm going to survive this anyway.

It does leave the lingering question of whether a forensic analysis of the drive would yield anything at all. If someone nefarious deleted a file in this manner, would a government team of forensic computer scientists be able to recover the data? Everything I know about computers says that the file wasn't deleted permanently enough, and that someone REALLY good should be able to find it. If that is not the case . . . well, then it seems like an all-too-simple permanent file removal method. What if it was on the computer for a day, or a week, not under 30 seconds? How about if a program besides the scanning software dealt with it? If it was printed or edited or emailed in a way that didn't make email a more viable recovery method?
. . . Okay, don't mind me, I'm just a geek who watches/reads way too much fiction about solving crime. Among my waves of relief, intellectual curiosity is spiking, but in general this thread is

RESOLVED.

Again, thanks for the help and support.
My System SpecsSystem Spec
Reply

 Must retrieve consecutively scanned files that overwrote each other




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
SFC couldn't repair files. Attempted to retrieve from install CD
Hey guys, I was wondering if you could lend me a hand over here. I've been having issues long time with my dual monitor set up crashing with video playback after a 3d application has been running. Me myself..I'm thinking it might be an issue with the card switching from 3D mode to 2D mode, but...
Performance & Maintenance
Windows Backup overwrote all my files. HELP!
For a few years my wife has resisted using any kind of backup solution even the built-in Windows backup. She has simply made her own backups on the root of an external drive. She simply copies all the files she wants to backup into a folder with the same name as her computer. ...
Backup and Restore
Have old XP C: & want to mount in new Win7 just to retrieve files. OK?
Trying to help my brother on this one. His old XP PC crashed before he could setup Easy Transfer. He has since bought a new Win7 PC & needs to access data from his old C:. So, I'm wondering if we mount his old XP's C: as an extra HDD, will his new Win7 PC boot properly or will it be confussed...
Hardware & Devices
Find missing files in a row of consecutively numbered files
I have like img0000.png img0001.png img0002.png etc up tp 5000
General Discussion
How do I retrieve backup files?
Hey everyone! I want to buy an external hard drive to back up my hard drive. I think I know how to backup files.;) My question is, if my computer ever breaks down because of a virus of anything major. How do I recover them from the backup I did to the external drive? I know someone might...
Backup and Restore
Using media center to back up and retrieve data files??
I'm trying to get some clarifications on using DVD's to back up data files and retrieving those backed up files. If you save files to a DVD-R, using WMC must all the files you wish to save be saved in the same session? Is it possible to add files to the same DVD-R in the future? Are the...
Media Center


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 21:53.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App