Home » Questions » Computers [ Ask a new question ]

Does NTFS overwrite file on the same physical location (sector)?

Does NTFS overwrite file on the same physical location (sector)?

I want to recover an overwritten file on a NTFS partition.

Asked by: Guest | Views: 145
Total answers/comments: 2
Guest [Entry]

"It depends on the application. Word, for example, writes a new file then deletes the old one so it will not overwrite it and it can be recovered. Another app might rewrite the file in place and then truncate to the correct size, in which case you will lose all the data.

if the file is truncated first (setting physical size, not logical size) and then rewritten, I'm not sure what would happen w/o testing it. If the old file is deleted then a new one created with the same name, I think it's a matter of chance.

If the file is small enough to fit in the MFT entry for the file (~4k?, I don't recall), you're more likely to have the data overwritten."
Guest [Entry]

It may or may not there is no way of knowing. NTFS will put write files wherever it thinks best there is no guarantee where it will place a file. If you want to recover a file do it as soon as possible, the longer you wait the more chance there will be that the old file will be overwritten.