PabloLec/RecoverPy

Define "overwritten"

poisonbl opened this issue · 1 comments

In your description, you have the rather enticing tagline:

Recover overwritten or deleted data.

In the realm of data recovery, "overwritten" is a loaded term. It means data blocks that have had other data written into them, not simply files that have been changed, replaced, etc. Given that, it seems misleading that you claim to be rescuing data that tools working through the drive's hardware/firmware simply won't return, even if traces of it might still be readable with an electron microscope... using basic Linux tools through the standard kernel' disk i/o APIs. I have a suspicion that you merely mean "overwritten" in terms of files themselves, not the data blocks beneath them, but it's prone to being misread and misunderstood.

Proof that it can be misunderstood in that way comes from where I found out about your project here:

https://www.reddit.com/r/sysadmin/comments/u4ue01/tool_to_recover_overwritten_data/?utm_source=share&utm_medium=web2x&context=3

Hi!

Just a quick share of a tool I recently discovered in a Reddit comment and which might be a lifesaver.
As we all know tools to recover deleted data but recovering overwritten data was until then, as far as I know, impossible.

It's not so bad for folks that have an understanding of data recovery, as the impossibility of the claim, read that way, is pretty obvious, but for those that only have a vague understanding of data recovery principles from reading about it in passing or such (i.e. overwriting data makes it unrecoverable, short of a nation state or very bored academic threat actor with an SEM), it's an incredibly misleading claim to make.

I think the term "overwritten file" in the description + the demo GIF in the README are pretty clear.
e.g anybody can understand old photo recovery are for scratches and faded colors, not a photo you flushed down the toilets. Or a mechanic can repair your old car but not if you set it on fire beforehand.

Well, I think it is fine this way, it is the same "claim" for any deleted files recovery software. You can't recover something you deleted years ago. And I guess asking the user to go check by himself if the partition blocks are still intact is... the whole purpose of this tool.
The capability to recover overwritten files is worth mentioning for this tool, that's something most known utilities like PhotoRec can't do. The fact that no software/tool could perform this task was the main reason I did RecoverPy.

Description + the whole readme look pretty clear to me but feel free to suggest a better description!