Solved Must retrieve consecutively scanned files that overwrote each other

[Halbfin]

Hello,

I scanned two files using a (newly acquired) Kodak i2900 document scanner, and was rushing. I saved both under the same (automatic) name in the same folder, and it didn't ask for overwrite confirmation. But it did overwrite the first statement.

I ran a search for all files modified at the time of scanning--They are all within one minute of each other. In order, I have:

1. Prefetch file (LEXEXE.EXE) from system Prefetch folder
2. PF file (LEXEXE.EXE) from system Prefetch folder (different hex tag)
3. Log from scanner software's Program Data folder
4. XML file in scanner software's Program Data folder (different subfolder)
5. PF file (LEXEXE.EXE) from system Prefetch folder (all new hex tag)
6. PF file (LEXEXE.EXE) from system Prefetch folder (yet another hex tag)
7. PF file (TWAINGUI.EXE) from system Prefetch folder
8. Shortcut to file name (a PDF document)
9. Shortcut to file name (exactly same as #8)
10. Shortcut to folder where I saved files
11. Ditto #10
12. PF file (KSSCFG.EXE) from system Prefetch folder
13. Log, as in #3
14. PF file (DLLHOST.EXE) from system folder
15. HST file from scanner software's Program Data folder
16. XML, as in #4
17. PDF document using the name I changed it to about 2 hours later
18. Ditto #17
19. Extensionless {} file from a folder regarding malware

Can anyone please, please, PLEASE help me retrieve the first file?


Can I use some sort of forensic technique to pull data from the prefetch files? The target files are PDFs; I use PDF-XChange Editor. Others in the office have Adobe Pro. The scanner program didn't open up the files, though.



I also wonder if it's still somewhere in the scanner, which automatically turned off after a certain amount of time.



My system is a Dell XPS 8700 running Windows 7 Home Premium 64-bit, with 8 GB RAM, Intel i7 @ 3.4 GHz.



This is . . . really bad for me if I can't retrieve it. I would be VERY grateful for any help in this area!!! (Right now I am in a panic.)


Thank you!

 

[Berton]

Unfortunately, once a file has been saved with the same name as an earlier file the earlier data is no longer available in most programs. Two files of the exact same name cannot be in the same Folder, one has to be at least one character different, the time, date, size, etc., don't make a difference, that has been a 'standard' for years, at least back to the late '80s when I started learning about computers for work and got my first computer in '92. Some programs may be able to retrieve a previous version but don't think so with scanning.

 

[Ztruker]

Can't you re-scan them?

You can try Recuva but no way to know if it will find the overlayed one or not.

 

[Halbfin]

Can't you re-scan them?

No, that is one of my big problems. I don't have access to the originals.

You can try Recuva but no way to know if it will find the overlayed one or not.

Yes, I'm going to look into that and similar programs. When I made the above post I was panicking and figured I didn't want to install anything for fear of overwriting the unallocated space that used to be the file; a calm friend later pointed out that many file recovery programs can be run from a live CD and my computer wrote plenty to unallocated space just by visiting this website. I'm on a different computer now and can research a bootable recovery program.

Thank you both for replying. Berton, I'm quite aware of this restriction. I was hoping that it left breadcrumbs somewhere from when it originally created the PDF, like in the prefetch files.

 

[LMiller7]

Prefetch files contain instructions to more optimally load applications. They do not contain any portion of the files themselves.

 

[Ztruker]

Prefetch files contain instructions to more optimally load applications. They do not contain any portion of the files themselves.

This made me curious so I searched and found this: What is the prefetch folder?

What is the prefetch folder?

Each time you turn on your computer, Windows keeps track of the way your computer starts and which programs you commonly open. Windows saves this information as a number of small files in the prefetch folder. The next time you turn on your computer, Windows refers to these files to help speed the start process.

The prefetch folder is a subfolder of the Windows system folder. The prefetch folder is self-maintaining, and there's no need to delete it or empty its contents. If you empty the folder, Windows and your programs will take longer to open the next time you turn on your computer.

 

[Halbfin]

I thank everyone who replied. It's good to know more about prefetch files, even if it doesn't help in this instance.

I'm going to mark this as resolved, even though the file was not recovered. After a night of research and contacting some people motivated by money, the conclusion is that the file isn't recoverable. Fortunately I have a great boss, so I'm going to survive this anyway.

It does leave the lingering question of whether a forensic analysis of the drive would yield anything at all. If someone nefarious deleted a file in this manner, would a government team of forensic computer scientists be able to recover the data? Everything I know about computers says that the file wasn't deleted permanently enough, and that someone REALLY good should be able to find it. If that is not the case . . . well, then it seems like an all-too-simple permanent file removal method. What if it was on the computer for a day, or a week, not under 30 seconds? How about if a program besides the scanning software dealt with it? If it was printed or edited or emailed in a way that didn't make email a more viable recovery method?
. . . Okay, don't mind me, I'm just a geek who watches/reads way too much fiction about solving crime. Among my waves of relief, intellectual curiosity is spiking, but in general this thread is

RESOLVED.

Again, thanks for the help and support.