> photorec, from the testdisk package, will retrieve all files from a > filesystem, deleted or otherwise. However it doesn't retrieve the names > so finding the right one will be fun :-O Grep will help immensely.
This implies that the new file data is not written over to the top of the old file - is that typically the case? Is it file system dependent? Is the file overwrite something like; - write new file data to spare blocks - move filename (hardlink) to point to the new block location
