Link to home
Start Free TrialLog in
Avatar of mebmmb
mebmmb

asked on

Move seems to have "lost" some of my files in WIN XP PRO and Outlook Express does not like my recovered DBX files.

Dear Experts --

I have a 2004 laptop with a 50 GIG INTERNAL HD.  This morning I moved some files (my *.DBX files for OUTLOOK EXPRESS) from the INTERNAL HARD DRIVE to an EXTERNAL HARD DRIVE.  This gave me 14 GIG of FREE SPACE.

I started a DISK DEFRAG.  The DEFRAG was taking more time then I allotted so I stopped it at about 30%.

I started the process to MOVE the files back onto the INTERNAL HARD DRIVE (see attached JPG) and all seemed to be going well until I realized that I saw the files DISAPPERING from the EXTERNAL HARD DRIVE but not APPEARING on the INTERNAL HARD DRIVE.

I know that I did not use a DELETE and the FREE SPACE on the INTERNAL HARD DRIVE was reduced by the same amount as the MISSING files.  The FREE SPACE on the INTERNAL HARD DRIVE went from approximately 14 GIG to approximately 10 GIG during the MOVE operation even though a SEARCH on the INTERNAL HARD DRIVE for *.DBX files shows nothing.

I have tried a CHECK DISK and the files did not reappear and neither did the space that they seem to be using.

I plan on giving DEFRAG a shot at this evening.

I have my DBX files backed up (last TUE) but I would like to get back the DBX files that have been hidden (a little more recent) or at least recover the space that these ghost files are occupying somehow.

The INTERNAL HARD DRIVE is an NTFS disk.

I have "recovered" the deleted files from the EXTERNAL HARD DRIVE using WinUndelete_Direct.exe but Outlook Express (my preferred e-mail client) does not want to deal with them for some reason.

Any suggestions?

Thanks.

 User generated image User generated image
SOLUTION
Avatar of chcw
chcw
Flag of Hong Kong image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of akahan
It sounds to me like you successfully moved the files back to the internal drive, but your search is not finding them.  Are you sure the files were not moved to a "hidden" or "system" directory that the search is not looking in, for example?  If the internal drive's free space shrunk in an amount equivalent to the size of the moved files, then the moved files are there... you're just not finding them with your search.
Avatar of mebmmb
mebmmb

ASKER

Experts --

I have recovered the dbx files from the TEMP folder they were moved to during the DEFRAG. When these were put into the OUTLOOK EXPRESS folder they came from, OUTLOOK EXPRESS recognized and used SOME of them. Unfortunately not the INBOX and SENT ITEMS that hold the most recent (lady 3 months) email.

The SEARCH function on my laptop has all of the options turned so that all files and folders show in a search so where-ever they went, they are not easily showing themselves.

They were not in the recycle bin for either the INTERNAL (C) or EXTERNAL (F) DRIVE.

I have copied the complete OUTLOOK EXPRESS FOLDER backup that I did last TUE to an EXTERNAL DRIVE ( a diifferent one) and I'm currently DEFRAGING my C DRIVE to clean things up.

I'll run another CHKDSK on the C DRIVE to try to recover the 4 GIG that seems to be being used by the GHOST DBX files. Then I'll COPY the backup OE files back into the appropriate folder and hope OE gets me back to LADT TUE.

After that I may use one of the tools suggested by CHCW up recover the few messages that are in my INBOX and SENT ITEMS between LAST TUE and YESTERDAY.

I'm leaving this question open because the problem is still being resolved.  I'll distribute points after the alarm bells stop ringing!  

Thanks.    

-- MEBMMB
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of mebmmb

ASKER

Experts --

After (carefully) copying the all of my LAST TUE backups of the OUTLOOK EXPRESS folder from my EXTERNAL HARD DRIVE back inton the OUTLOOK EXPRESS FOLDER and restarting OUTLOOK EXPRESS, I have access to all of my e-mail with a gap from LAST TUE to TODAY.

I will probably try CHCW's suggestion to recover the e-mails that are in the "gap".

I'm still "missing" about 4 GIG of space on my C DRIVE.  I've DEFRAGed and CHKDSKed and the space still seems to be tied up somehow.

Any suggestions on recovering this.  With a 50 GIG hard drive, 4 GIG is about 10% that I'm missing.  I'd love to get it back.

Perhaps the answer is in the fact that I "explored" to the folder via a shortcut . . .

I have a shortcut to OUTLOOK EXPRESS sitting in a folder on the START MENU.
I can open the folder by RIGHT CLICKING on the shortcut and then manipulate the files within.

The location of this shortcut seems to give it some "interesting" characteristics.

Maybe that is why a DRAG and DROP MOVE did not work properly.

Any thoughts?

Thanks.

-- MEBMMB
Do you believe the emails in the gap will occupy 4GB data?
Avatar of mebmmb

ASKER

I guess there needs to be some additional information here . . .

The OUTLOOK EXPRESS files that show as MOVED (that total about 4 GIG) in the JPG attached to this question included my CURRENT INBOX and CURRENT SENT ITEMS files (Windows view) / folders (Outlook Express view)

These files never showed up at their DESTINATION but were deleted from their SOURCE during the MOVE operation.

Since I have repopulated my OUTLOOK EXPRESS folder with a backup I made on TUE-02-NOV, there were E-MAILS that I sent and received since TUE that were not in the LAST TUE versions of these DBX files.

The DBX files that "evaporated" were about 4 GIG.  Not the individual e-mails received since last TUE.

Thanks.

-- MEBMMB

OK. I see.
Make sure that ALL the DBX files you have copied, moved, archived, or stored somewhere are in appropriately named folders so you can easily identify which ones are which, or else you will quickly lose track.

Download Michal Mutl's "Mail Viewer" (v. 1.6.1.0) which is a zipped standalone program:
http://www.mitec.cz/mailview.html
http://www.mitec.cz/Downloads/MailView.zip

Run it and choose File > Upen.
In the dialog, select "Outlook Express Message Database" and then click the "Browse" button.
Locate each DBX file that may contain the missing messages, click OK, and wait for it to load in a layout not dissimilar to Outlook Express message view.

If you find them, tick them and use the Message menu > Save > "Email".
That will save them as *.eml files. The file name will not matter for now. It's usually best to first create a destination folder on your desktop for this.

Close Mail View, open the folder where you saved the *.eml files, and then open Outlook Express. Change the OE window size so you can see the contents of the folder beside/behind OE. Create a new OE folder and click so that you have an empty message area. Toggling the taskbar buttons for OE and Windows Explorer, bring the folder into focus and select the *.eml files. Drag them across onto the empty message area and drop. If OE keeps minimizing, drag the files down to the OE taskbar button to bring it up into focus and drop into the blank space.

Close and reopen OE then move the messages into whatever folder you wish.

If MailView doesn't show the missing messages, all may not yet be lost.  I have previously described a method of extracting the DBX database that sometimes gets files that MailView and other similar "DBX Viewers" don't show:
https://www.experts-exchange.com/questions/24833639/Outlook-express-Sent-Items-2-Gigabyte-problem.html
I'm also curious to know what you believe may have altered the way you moved the DBX files to begin with. You said:

>>>>
Perhaps the answer is in the fact that I "explored" to the folder via a shortcut . I have a shortcut to OUTLOOK EXPRESS sitting in a folder on the START MENU.
I can open the folder by RIGHT CLICKING on the shortcut and then manipulate the files within.  The location of this shortcut seems to give it some "interesting" characteristics.
<<<<

A shortcut to your OE "Store Folder" like this:

%windir%\explorer.exe "C:\Documents and Settings\You\Local Settings\Application Data\Identities\{ABC12345-xxx-xxx-xxx-xxxxxxxxxxxx}\Microsoft\Outlook Express"

should not give the folder that opens any intereseting characteristics, apart from the fact that the icon will be a "My Computer" icon. Remove the preceding %windir%\explorer.exe and the shortcut will show with the normal explorer icon, but do the same thing. No need to Right-Click anything, just double-click to open the folder.
Avatar of mebmmb

ASKER

BillDL --

Thank you for your info and suggestions.

I believe that if you look carefully, you will seek that the jpg image shows that the destination for my MOVE command was a SHORTCUT even though I was doing a move to an open window. I wonder how / why that window knows / cares how it was opened. This is one of the strange characters of this SHORTCUT.

Another is that in a program I use named SPACEMONGER, the files in the OUTLOOK EXPRESS folder sow up twice. Once cataloged normally and once cataloged under the shortcut. I know the program is looking at the same folder because a TXT file created on "either" location show up in both locations.

I'll look into your suggestions about recovering my TUE to MON emails asap. Fortunately the dates on the INBOX and SENT ITEMS dbx files tell me what version they are.

Do you have any suggestions on a utility to fin / eliminate the ghost files that are consuming 4 GOG of space on my drive?  I have very little (2 gig) free space on this 50 gig drive. I *N*E*E*D* this space back!

-- MEBMMB
I admit that I hadn't taken the time to look at the screenshots and realise that you had used a 3rd-party program (TeraCopy) to "back up" your DBX files.

So, the program MOVED 3.7GB of the 10.7GB to the destination:

C:\Documents and Settings\All Users\Start Menu\Special Folders\Shortcut to Outlook Express\

using names in the destination like "2007-MMB-Inbox.dbx"

Your Outlook Express "Store Folder" was F:\Outlook Express, which you obviously at some time set in Outlook Express Tools > Options > maintenance tab.

Right-Click on the Start Menu shortcut (if it is a shortcut) named "Shortcut to Outlook Express" and choose "Properties".  First of all, what file size is it, and secondly what shows as the "Target" under the "Shortcut" tab?

A proper Windows shortcut file has the extension *.LNK, and you can verify this by using the DIR command on a destination folder, eg:

dir /a-d /on /b "C:\Documents and Settings\All Users\Start Menu\Special Folders\*.LNK"

Are your F:\ and C:\ Drives both formatted as NTFS or FAT32?

NTFS supports something called ADS (Alternate Data Streams) in which one file or a data stream can be embedded into another file or folder using what amounts to nothing more than a simple "copy" command with a redirect to the destination.  Viruses use this method frequently to embed data as "rootkits", because a rogue file can be run from inside another, but there are a lot more legitimate uses of ADS such as the little security "flag" that is embedded into files downloaded from another computer and ause a security prompt to show when you go to open them.

My suspicion is that your "Shortcut to Outlook Express" file may now have 3.7GB or more of data copied into it by the TeraCopy program.  Most programs would halt with an error and tell you that the destination specified was not a valid directory, but perhaps TeraCopy would just blindly gone ahead and embedded the data into a destination file.

There is a little command line program named Streams" that allows you to see Alternate data Streams inside files:

http://technet.microsoft.com/en-us/sysinternals/bb897440.aspx

http://download.sysinternals.com/Files/Streams.zip

Place "streams.exe" into your C:\Windows\System32 folder so that you can execute it from the command line without specifying the path to it.  Then try the following command to see what it shows, if anything:

streams "C:\Documents and Settings\All Users\Start Menu\Special Folders\Shortcut to Outlook Express.lnk"

Ideally what we are looking for, if my suspicion holds water, is some mention in the output of "dbx".

Let us know the results.

Bill

Actually, on thinking about this a bit more, Alternate Data Streasm do not increase the file size as shown in Windows Explorer or the "DOS" DIR command.

So maybe I'm barking up the wrong tree, but nevertherless, it would be worth just checking if the "shortcut" has embedded data in it.

I looked up an old resource that I have used for a long time now, which is a DLL file that can b registered to show a new "streams" tab in the file properties dialog, and which might provide a quick way to see if the shortcut contains additional ADS:
http://download.microsoft.com/download/f/c/6/fc6943eb-790a-44aa-b32d-14ed7e22fd5d/ntfsext.exe

Extract the file and copy "StrmExt.dll" to the C:\Windows\System32 folder, then run the command     regsvr32 StrmExt.dll   to create the new tab.

To remove it (unregister it) run the command   regsvr32 /u StrmExt.dll   and then delete StrmExt.dll from the System32 folder.

It is explained in the following pages:
http://www.heysoft.de/en/information/ntfs-ads.php
http://www.forensicfocus.com/dissecting-ntfs-hidden-streams

Avatar of mebmmb

ASKER

BillDL --

Thank you for your suggestion and links.

There are a couple of things that are not accurate in your summary.

OUTLOOK EXPRESS is configured to work from the following folder:

C:\Documents and Settings\Matt\Local Settings\Application Data\Identities\{ACEE249B-0C16-491C-B19E-348F8295C81C}\Microsoft\Outlook Express

The SHORTCUT gives me quick access to that folder because I watch its contents like a hawk due to my limited disk space.

The path to the SHORTCUT IS:

C:\Documents and Settings\All Users\Start Menu\Special Folders\Shortcut to Outlook Express

The files that were / are stored on the F DRIVE in F:\OUTLOOK EXPRESS were MOVED there from
C:\Documents and Settings\Matt\Local Settings\Application Data\Identities\{ACEE249B-0C16-491C-B19E-348F8295C81C}\Microsoft\Outlook Express so that I could free up enough space for DEFRAG to run completely.

I ran STREAMS on the LNK file by putting STREAMS in a folder (C:\2010-11-15\), doing a CD to change to the SPECIAL FOLDERS folder, then running STREAMS (see attached).

The result was a "NO FILES WITH STREAMS FOUND" message.

If the LNK file has a stream attached, would deleting the LNK file and recreating it manually eliminate this disk consumption?

While attaching this screen capture of the DOS prompt (2010-11-15-094945.JPG), I noticed that you can see within this window, you can see that from this "view" it looks like this SHORTCUT is a DIRECTORY.   From another "perspective" this shortcut looks like a shortcut ().

Thanks.

-- MEBMMB
 User generated image User generated image
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Correction.

In Note 4 I stated:
It isn't possible in Windows Explorer to see the properties of the Start Menu "shortcut" though.

I meant to say:
It isn't possible in Windows Explorer to see the properties of the this kind of Start Menu "shortcut" to a Folder.

You can see properties for normal shortcuts.
Avatar of mebmmb

ASKER

Experts --

BillDL's post "11/16/10 12:11 PM, ID: 34147876" hit the nail on the head.

While I had always been "concerned" about the special behaviour I saw from that "SHORTCUT" I never had a problem with it before.

After opening a CMD window in the SPECIAL FOLDERS folder, I gave the

attrib -h -r -s "C:\Documents and Settings\All Users\Start Menu\Special Folders\Shortcut to Outlook Express"

command he suggested.

Then windows was "happy" to show me the 6 GIG of files that had been stored in the "SHORTCUT".

I MOVED the offending "SHORTCUT" into the TRASH CAN, verified that the actual OUTLOOK EXPRESS folder still existed and then emptied the TRASH CAN.

Now my LAPTOP has 8 GIG of FREE SPACE!

YAY!

I'm going to split the points for this question 2 ways.  Information provided by CHCW helped me recover the DBX files "deleted" from the F Drive by the TERACOPY program and maybe the e-mails from the days between "last tue" and "mon".  BILLDL's SUPER SUPER VALUABLE explanation allowed me to recover the valuable drive space consumed by these "ghost" files.

CHCW and BILLDL ROCK!

-- MEBMMB
Avatar of mebmmb

ASKER

About the only thing better would have been if the EXPERTS sat down at my computer and ran through the solutions for me.

-- MEBMMB
Thank you for your kind words Matt. I'm really glad you have recovered the emails, reclaimed the missing space, and that the problem has explained. There's nothing worse than tearing your hair out wondering why something happened - I know, I'm pretty bald on top now and I'm sure that's what caused it ;-)

I wonder if the following free "Replicator" utility program by Karen Kenworthy might be of help to you:
http://www.karenware.com/powertools/ptreplicator.asp
It's pretty easy to configure and schedule a new "job" that keeps an up-to-date backup (on another hard drive partition or external drive) of the files and/or folders you specify.

Edit Settings > New Job > Name the job.
Set source and destination folders > Edit Filters (specify file types to include/exclude.
Change Schedule and Enable it.
* Disable "Replication" of Folder and File deletions * (you don't want source files deleted if you delete destination ones and vice-versa ie. synchronising either way)
Save Job.
Other Settings tab - optional settings.
Save
Save and Close dialog
Create another job for different folders/file types if desired.
Verify Settings > Exit > choose Minimize to System Tray
Job settings are stored in:
C:\Documents and Settings\Matt\Local Settings\Application Data\Karen's Power Tools\Replicator
but they are not in an easily editable format.

This is what effortlessly backs up my Father's "My Documents", emails, etc to an internal slave drive on a daily basis.  It was easy to schedile because he is very regimented and I know what times he normally uses the computer, and is pretty quick because it is just doing incremental backups :-)

Regards
Bill
Avatar of mebmmb

ASKER

Bill --

Thanks for the additional information.  I'll look into PTREPLICATOR.  I have been using two tools for this . . . BACKER (CORDES DEVELOPMENT) and TERACOPY (CODESECTOR).  PTREPLICATOR sounds like it is much like BACKER in that it will SYNCRONIZE / BACKUP a SOURCE and a DESTINATION folder with different options.  TERACOPY is also a handy tool in that you can DRAG and DROP to designate the SOURCE and the DESTINATION then you get a prompt for the options so that only NEW or MODIFIED files are COPIED or MOVED.  This REPLACE OLDER ONLY mode speeds things up dramatically.

Perhaps that is an area that EXPERTS-EXCHANGE can branch into . . . Having a list of TRIED AND TRUE UTILITIES that are recommended / reviewed by the EXPERTS.  I took a glance and did not see anything like that in the headings on the web page.

Thanks again.

-- Matt