Originally posted by: Laputa
Data are written in 0s and 1s in terms of sectors at the hardware level with 1-bit of information at a time. There's no turning back at the physical level unless there's another copy somewhere that has not been touched. That's probably what you are getting with those tmp files since too much has been done written back to the drive after that file got overwritten. If stopped using the drive immediately and perform the recovery attempt, the tmp file is probably good. You'll get the file with any recovery program out there, but most likely they will be corrupt because the data bits structures are different than what it was comparing the MFT with the CRC record.
There's no turning back at the physical level unless there's another copy somewhere that has not been touched.
