This is the page where the answer is sometimes no. Where new data has physically taken the place of the old, nothing recovers it, and any firm telling you otherwise is selling you something. What saves most of these jobs is that the file people describe as overwritten frequently has not been.
One drive searched, £300 + VAT. Logical work, so no fix, no fee applies and there is nothing to pay if the earlier version does not come back. The free diagnostic closes 2 working days after the drive reaches Guildford.
Nearly everybody who rings about an overwritten file is describing one of these six situations. Which one you are in decides everything that follows, and it is worth working out before you spend any money.
The document was opened, edited and saved under the same name, and the version you wanted was the one that was there before. On disk this is rarely a true overwrite, because most programs write a new temporary file and then rename it, which leaves the earlier copy sitting intact in free space.
Windows asked whether to replace the files at the destination and somebody chose replace. Each replaced file has a fair chance of surviving in free space for the same reason as above, and the odds fall with every hour the machine keeps being used afterwards.
A backup from March put back over June work is a large and deliberate write, and it tends to land on precisely what you wanted. This is one of the harder cases on the page, although shadow copies and cloud version history often hold the answer where the disk does not.
Mirror modes exist to make a destination identical to a source, deletions included, and pointing one the wrong way empties a folder in seconds. The deletions themselves are ordinary deletions and are frequently recoverable. What overwrote what depends entirely on how much was copied afterwards.
A fresh Windows or macOS installation writes a few gigabytes at the front of the disk and formats the volume around it. On a large disk that is a partial overwrite, so most of what was there survives, and the job becomes a search of everything the installation never touched.
A large file rewritten in place, a virtual disk that has kept running for weeks, or a drive that has been securely wiped. There is no recovery here and no equipment that changes that. What is still worth checking is whether a second copy exists somewhere the machine has forgotten to mention.
A hard disk stores each bit as a magnetic orientation in a track a fraction of a micron wide, and writing new data changes that orientation. There is no older layer underneath it, no faint echo of the previous value, and no laboratory technique that reads one. The notion that there might be comes from a paper written in the mid-1990s about drive technology that has not been manufactured for decades, and it has outlived the hardware it described by a very long way. On the perpendicular and shingled recording used in every drive made this century, a single pass leaves nothing behind to interpret. Any firm offering to recover a file from beneath the file that replaced it is describing something that does not exist, and the rest of what they tell you deserves the same weight.
Applications are lazy in a way that helps here. When a program saves a document it usually writes the new version out as a fresh temporary file, checks it, deletes the old one and renames the new. The previous content is now unreferenced rather than replaced, sitting in free space until something else happens to be allocated over it. The same holds for most copy operations, most database engines and most photo editors. So the honest position after somebody saves over a file is that the earlier version very often still exists, nameless, in the space the file system regards as empty, and the only clock that matters is how much has been written to that drive since.
On a spinning disk the new version tends to land somewhere else entirely and the old one stays put until the space is reused, which on a drive that is not busy can be months. Solid state storage inverts this. Wear levelling means the controller almost never writes to the same physical cells twice in succession, so the old copy does survive the write itself, but TRIM then tells the drive that the block holding it is free and the controller erases it in the background within minutes. Both kinds of hardware leave a window. On a hard disk it is generous. On an SSD it is measured in minutes, and closing it means taking the power off.
Right-click the file, or the folder that held it, choose Properties and look at the Previous Versions tab. That list is fed by volume shadow copies, which Windows creates around updates and restore points and which hold a frozen picture of the file system at that moment. File History, where it was ever switched on, is a second source, and it survives even when the original volume does not. Office keeps its own safety nets on top of that: autorecover files, the versions listed under File and then Info, and stray .asd and .wbk files that outlive the document they belonged to. None of this needs a laboratory, and half an hour spent on it before anybody pays for anything is half an hour well spent.
OneDrive, SharePoint, Dropbox and Google Drive all retain previous versions of files for a period measured in weeks or months, and they retain them on the server, which means an overwrite on your machine does not remove them. If the folder sat inside a synced location, the version you want is probably waiting in a web interface rather than on the disk in front of you. The same applies to Time Machine and to the local APFS snapshots a Mac quietly keeps on its own internal disk. Check all of that before posting anything anywhere.
The drive is imaged and the search runs against the image. Free space is examined for file system records that still describe the earlier version, for the temporary files applications left behind, and for the content itself by signature. Partial overwrites deserve naming as a category of their own: where only the first part of a file has been reused, the remainder is frequently still readable, and for a video, a database or a disk image that can be most of the value. On office documents the same principle recovers the text if not the formatting. Results of that kind are not always clean, and they are described plainly in the report rather than dressed up.
One drive is £300 + VAT with NVMe included, and cards and sticks are £250 + VAT. This is logical work, so no fix, no fee applies: if the earlier version does not come back, there is nothing to pay. Nothing is charged for the diagnostic either, and it closes 2 working days after the drive reaches the bench, never sooner. Post it to Guildford Data Recovery, Building 2, Ground Floor, Guildford Business Park, Guildford GU2 8XH, about 40 minutes from Bracknell down the A322 and the A3 if you would rather bring it, and next working day by tracked post if not. Reception takes drop-offs in office hours. Nothing is collected from anywhere and there is no Bracknell counter. Where time matters, and with an SSD it always does, ring 0800 689 0668 before that machine is used again. Bands for everything else are set out on the data recovery cost page, VAT shown separately.
Shut it down, check the version history, and let a free diagnostic say whether the earlier copy is still there.
Almost every drive on this bench arrived in a padded box. Tracked post is the gentlest way to move a disk that is already in trouble, and a parcel handed in around Bracknell is usually in Guildford the next working day.
Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.
Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.