Recover a replaced file with the same name
Hi, is there any chance recover a replaced file with the same name using FTK or EnCase?
It's probably gone forever, unless you have a backup.
Depending on the file type and other factors (File system, file size, O/S, amount of time past since deletion, etc..) there is a small chance you can 'carve' the file.
Also depends on how the file was replaced. Deleted and recreated, or opened and overwritten.
Also check Volume Shadow Copies.