3

I was working on a file (Excel, from MS Office Professional Plus 2016) stored on the local drive of my laptop, in which I entered marks of my students for papers.

Later, I reopened the same file and replaced the paper marks with assignment marks; I intended to use "save as" the file rather than save, but accidentally pressed Ctrl+S; then I realized I overwrite the previous file version, replacing the file contents, rather than creating a new file.

How can I restore the older version of my Excel file, which contained paper marks??

I tried using the Windows 10 "restore previous version" option as shown in this screenshot, but I couldn't find a previous version there.

snapshot

  • 1
    The "save as" should always be the first action. In fact, you want to get in the habit of making a copy of the file before even opening it. – cybernetic.nomad Oct 9 at 17:35
  • 2
    Where is the document saved? Some servers provide ways to retrieve previous versions of documents. Many online storage locations (SharePoint, OneDrive, etc.) do as well. – Twisty Impersonator Oct 9 at 17:38
  • 1
    Document is saved in my laptop – engr Oct 9 at 17:46
  • 1
    @cybernetic.nomad - The key here is that it was 'saved over'.In these cases there is very little chance of recovering the original document unless you can do a deep dive on the hard drive for a conventionally deleted tmp copy of the one you're looking for. Believe me, I've tried. – Jeeped Oct 10 at 0:28
  • 2
2

Free continuous backup software like DeltaCopy would allow you to pull the previous versions out of the backup destination, and that's a good thing to implement once you have recovered the desired version of your file.

This process instead discusses how to recover a modified (or deleted) file using an Open Source tool, Photorec, available for all three major OS families.

The more you use that PC, the lower the chance of recovering the original file.

When you modify and save (or a Windows app autosaves) a file, the prior version of the file is thrown away. It's probably still there, for Windows does not normally truly erase a deleted or modified file, instead marking the space the file previously used as reusable. If the file is erased, Windows then breaks the link between the space used by the file to the file name; if the file is modified, Windows changes the link of the file name to point to the new location.

Windows has written and replaced 3,600+ files so far today in six hours of use on my PC, and probably thousands on yours; it is very disk-intensive. Therefore, please abstain from using your PC for anything until you do these recovery steps.

This is a (personally) verified process I've used for years at https://www.freegeek.org/shop/tech-support and elsewhere (Note: I do not speak for Freegeek).

a) Download the Testdisk software file for your OS.
b) Extract its files to a directory on a drive (an external USB attached drive is recommended) which was NOT used to save the desired Excel file.
c) Read the README file.
d) Launch Photorec.
e) Specify recovery from the source drive where the file was.
f) Specify recovery to a destination drive (so it is not overwriting any clusters which might contain your data).
g) Start the recovery scan.
h) When scan completes, open the destination directory. File name will have been randomly assigned by Photorec but the extension will match what you're looking for. i) Open each of the recovered Excel files which match the size (plus/minus 5%) of the file in question. Check to see what they contain. Delete them if not what you want.

  • 2
    It's not about a file been deleted but modified. To me it's not clear how this answers the question or did I miss anything? – Albin Oct 10 at 7:38
  • @Albin Were that so, photorec and other recovery tools would not work at all. Instead, the new contents are written to a disused location, one or more clusters (depending on file size). The MFT (Master File Table) is updated to point to the new location of the first cluster (which points to clusters which follow), and then the old location is marked as reusable. Also see ntfs.com/file-recovery-concepts.htm fossbytes.com/delete-vs-erase-vs-shred-vs-wipe-difference-use "What is Delete?" – K7AAY Oct 11 at 16:06
  • @Albin Eppur si muove! Verified my assertion 10 min ago by 1) Erasing all files from an NTFS drive "E:". 2) Save version 1 of an Excel XLSX file to E: 3) Opened the file from E: 4) Made a change to that file. 5) Re-saved the file on E: 6) Exited Excel. 7) Launched photorec, specified recovery from E: 8) Photorec found the old version of the XLSX file (not a TMP file) which opened w/ the original data. || Perhaps it would help to have done file recovery for customers in real life as I did at freegeek.org/shop/tech-support , but this is an experiment you can replicate yourself. – K7AAY Oct 11 at 16:53
  • Let us continue this discussion in chat. – Albin Oct 11 at 17:29
  • Ok, now I understand what you mean. You are actually recovering deleted temp files. But this only works if the files can still be recovered and are not overwritten with other data. – Albin Oct 12 at 19:43
2

If you didn't recover the deleted temporary files right away (see solution to recover previous versions from temp files below), restoring your previous version most likely won't be possible unless previously:

  • you activated Windows 10's File History which requires at least two drives (e.g. see here), then and only then you can recover a previous versions (as you already discovered)

  • you were using onedrive to save the excel file, then you can recover (e.g. see here)

  • you have done some type of backup which you can use to restore the file from

Since the file and it's data in most cases has been overwritten unfortunately there are no other (easy) file recover options. However you might be lucky since Excel produces several temporary files.

Solution to recover previous versions from temp files

However, you might be able to recover it is through your (deleted) temporary files Excel produced. That is assuming the data hasn't been overwritten by the OS for other/new files - to minimize that chance, this is important: you should stop using the drive your file is stored on (or if possible stop using the computer altogether). If it's still there you might be able to restore your old file from there.

Note, depending on the Excel version, there are several types of temporary files Excel creates in several locations which are deleted after you save your file and/or close Excel:

  • one that carry the same name then your original file with a ~$ in the beginning (the one that can see being created when you open it)

  • a second type that you can only see when you recover deleted files on the drive where your excel file is located. The file might have a different name/extension but file size will be exactly the one your previous version had (since it actually is your previous file). The name might be something like F545F41.tmp (where the meta data of the deleted file, like filename, date etc. is still intact) or 002322.xlsx (where the file's metadata has been deleted, in this case the filename) depending on various factors mainly on which excel file was saved last. These files are created and deleted due to the process how Excel saves files: instead of modifying your original file, Office it creates a new file and renames and deletes the old one containing the old version (tested with Office 365 V1909). The tmp file (if it exists) is your last version of the excelfile, the other files are all sorts of previous versions (might be the last version or even older versions).

  • third there are additional temp files that are saved in other directories used for storing temp files (depending on your windows and office/excel version). With luck those files haven't been deleted yet, otherwise you need to recover them as well. Here are some more information about the Excel AutoRecover Process that creates some of those files.

For recovery of deleted files you can use any decent recovery tool that does a "deep scan" of your drive e.g. Recuva. Depending on the size of your drive this might take a long time. Once you recovered your temp files you can open the second type you can open directly with excel (since this actually is your original file). The other types (especially the temp files that haven't been deleted) you need to "recover" a second time, with one of those instructions for example this superuser one or this external one.

As a side note

For tmp files with the name still intact eg. F545F41.tmp you can find the correct file/(name) using the USN file journal that is implemented within NTFS, assuming it was turned on. To create a log of the file journal you can use CMD (in admin mode):

fsutil usn readjournal [drive] > [logfile destination]

e.g. if your excel file was on drive C: and you want the log to be saved as D:\USNlog.txt use this line:

fsutil usn readjournal c: > D:\USNlog.txt

There you can retrace through the File-ID which files were deleted/renamed etc.

  • For years, I've also tried to recover the tmp file that xl typically generates. – Jeeped Oct 10 at 0:31
  • yeah you are right, but wouldn't excel overwirte those files as well? Anyway I added this possibility to my solution, thanks. – Albin Oct 10 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.