Data recovery

Posted on 2006-03-22
Last Modified: 2013-12-01

some important data on my harddisk have disappeared yesterday. I'm not sure if I deleted them accidently or any virus did it. Is it possible in Windows xp to show which operations (such as delete, create) have been performed during the last time?

The lost data are mostly .txt files and also some Word and PDF files. Do you know any powerful data recovery freeware to get the data back?
I've tried some free demo versions, but they donot seem to work well.

Question by:dataminer
    LVL 57

    Expert Comment

    by:Pete Long
    File Recovery

    When a file is deleted either from the Network, By a program or from the Command Line, is does not get put into the recycle bin. However the file is NOT erased, instead the information that points to the file is erased. By erasing the pointer, the file becomes "Invisible" to the Operating system. Using Third party software these files can be recovered.

    NOTE: remove the offending Hard Drive and fit in in a working PC as a slave drive - Deleted files get overwritten FIRST so just installing recovery software can over-write them.

    **********Freeware Recovery Tools**********

    Deleted File Analysis

    PC Inspector
    (FAT 12/16/32 NTFS)

    (Also have a Netware version - NOT FREE)

    **********TrialWare Recovery Tools**********

    Undelete 3.0 (30 Day trial available)
    (NT/2K/XP) - Can run direct from the CD

    File Recover

    (FAT12/16/32 NTFS NTFS5 and Ext2FS)

    Recover My Files

    **********Shareware Recovery Tools**********

    File Scavenger
    (NT/2K/XP) - Supports Reformatted Volumes -Limited to 32Kb file size!

    GetDataBack for FAT
    (FAT) Works Even After FDisk and Format, Can run Over the network.

    GetDataBack for NTFS
    (NTFS) Works Even After FDisk and Format, Can run Over the network.

    Active@ UNDELETE
    (FAT 12/16/32 NTFS) Runs From MMC Console

    Active@ UNERASER
    (FAT 12/16/32 NTFS) Runs from DOS Bootdisk

    FinalData Plus

    ************Commercial Products************

    File Restore ($39.00)

    HDR Data Recovery ($485.00) Trail available

    **********Good Link to More Info***********
    Video Tutorial
    LVL 87

    Expert Comment

    You might be able to turn on auditing (in the policies, but probably only available to xp pro, not home) in order to get events like that logged, but you'd have to have done that prior to it having happened, and it won't be possible to get all the details which you'd probably want!

    First check in your recycle bin, maybe the files are there!

    I haven't tried recovery with freeware, but you can find out if things are recoverable using getdataback, then you'd have to pay for the software to actually restore the files
    LVL 7

    Expert Comment

    Hi There,

    Below are Freeware PC Inspector File Recovery  and others  
    which you may like to try to download and see if solve your problem
    PC Inspector File Recovery is a data recovery program with support for FAT 12/16/32 and NTFS file systems. It recovers files with the original time and date stamp, and can optionally restore them to a network drive and can recover many files, even when a header entry is no longer available. On FAT systems, the programs finds partitions automatically, even if the boot sector or FAT has been erased or damaged. PC Inspector File Recovery offers an easy to use interface that will scan your drive and automatically make files that can be recovered available from a "Deleted" folder in an Explorer Style navigation tree.

    Listed are 2  commerical Softwares which are very good recovery tool which you may also consider.

    Dependingon your OS you format your drive...
    GetDataBack for NTFS V3.01
    Recover your files when the data is no longer accessible due to formatting, fdisk, virus attack, power or software failure. Get everything back even when the drive's partition table, boot record, Master File Table or root directory is lost or corrupt.

    or GetDataBack for FAT V3.01
    GetDataBack will help you retrieve your files if the hard drive's partition table, boot record, FAT, or root directory have been damaged by a virus, formatting, fdisk or power failure. GetDataBack can even recover your data when the drive is no longer recognized by Windows.

    Also another good one that also reciver disk partitions etc
    Acronis Disk Director Suite 10
    Acronis Disk Director Suite 10.0 is a comprehensive workstation partition and disk management suite that combines a number of previous Acronis products into one solution:

     Acronis Partition Expert allows you to resize, move, copy, split, and merge partitions without losing your data
     Acronis OS Selector is a multi-boot software utility that allows you to install multiple operating systems on your PC
     Acronis Recovery Expert allows you to recover accidentally lost or deleted partitions
     Acronis Disk Editor is a disk drive repair tool that allows you to perform advanced operations on your hard disk drive, such as restoration of boot records and hexadecimal editing

    Best of lucks




    Author Comment

    Hi all,

    thanks for the quick reply. I followed imacgouf's link and found a "File Scavenger", which seems to perform fairly well. I could find almost all files deleted from today back to the year 2001, EXCEPT the files that I realy want to find!??
    Perhaps I didnot really delete them?? But I cannot find them anymore on my harddisk. I guess if I did a "Cut & Paste", the original files should be deleted and thus should also be found by the recovery software.

    I checked the recycle bin, my files are not there.


    Author Comment

    or perhaps a virus is so intelligent that it immediately rewrites the files after it deleted them?
    LVL 87

    Expert Comment

    Use the "search" utility of windows to look for the files, as you might not have deleted them but rather moved them to some other place.

    Author Comment

    I've searched the whole computer with different possible keywords that are contained in the name or content of the files, but could not find the files.
    LVL 87

    Accepted Solution

    maybe you also renamed the files? or you moved the files to an external media like a USB HD or a writable CD?

    Author Comment

    they are thousands of files which I cannot change their names or contents individually. I did not use any USB HD and there is no writable CD in  the drive.

    My system works now quite unstable, during the time that I ask this question my computer crashed twice. I must completely shut the computer down and then restart to run it normally.

    Could a virus or a hacker be the reason for the data lost?

    Author Comment

    But I then wonder how did they do it so that the files can neither be found nor be recovered.

    I recently have problem with the goold desktop which always gives error message like "google desktop cannot ?? successfully" or sth like that. Could this be the reson?
    LVL 87

    Expert Comment

    Files get written over when they are deleted and you don't immediately stop using the system. This overwriting can be random so some files will still be recoverable and others won't. Usually if there is a large contiguous space in the deleted area that would be used first when allocating diskspace to new files, so it is more likely that small files that were in fragmented areas on the disk can be recovered than large ones which weren't in the fragmented area.

    Download the latest version of HijackThis

    run it and save the log. Paste the log to the following website

    Follow the following exactly:

    At the bottom of the page you'll see a "ANALYZE" button. Click it and you will have an analysis of your log. Now a new button, "SAVE ANALYSIS" will show up at the bottom. Your analyzed log will be saved to a page on that homepage, of which you can post the URL here. I should then be able to see if there is any software causing problems.

    Author Comment

    LVL 17

    Expert Comment

    LVL 7

    Expert Comment

    REcover MyFiles software is the best to recover the deleted files even after re-formatting the drive or deleting the partition try this out

    This is a trial software when you run this program it will show you all the deleted files and which can be recovered, in order to recover them you have to buy the license which will cost you 70$

    I am not sure whether any freeware is available to retrieve the lost data. When you are running this software search for only those files you want to retrieve as u said textfiles, word docs etc. This is will make the search fast
    LVL 87

    Expert Comment

    Use hijackthis to remove the following:

    R3 - URLSearchHook: (no name) - _{2C5AA40E-8814-4EB6-876E-7EFB8B3F9662} - (no file)
    O2 - BHO: (no name) - {68AE6707-B217-7FC6-8207-6D557CAF2869} - C:\WINDOWS\System32\weyoih.dll (file missing)
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Microsoft AOL Instant Messenger] MSAOL32.exe
    O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
    O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
    O4 - HKLM\..\RunServices: [Microsoft AOL Instant Messenger] MSAOL32.exe
    O4 - HKCU\..\Run: [Microsoft AOL Instant Messenger] MSAOL32.exe
    O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
    O15 - Trusted Zone: * (HKLM)
    O15 - Trusted IP range: (HKLM)
    O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
    O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} -

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Join & Write a Comment

    Having issues meeting security compliance criteria because of those pesky USB drives? Then I can help you! This article will explain how to disable USB Mass Storage devices in Windows Server 2008 R2.
    A quick step-by-step overview of installing and configuring Carbonite Server Backup.
    This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
    This Micro Tutorial will teach you how to reformat your flash drive. Sometimes your flash drive may have issues carrying files so this will completely restore it to manufacturing settings. Make sure to backup all files before reformatting. This w…

    745 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now