Data recovery


some important data on my harddisk have disappeared yesterday. I'm not sure if I deleted them accidently or any virus did it. Is it possible in Windows xp to show which operations (such as delete, create) have been performed during the last time?

The lost data are mostly .txt files and also some Word and PDF files. Do you know any powerful data recovery freeware to get the data back?
I've tried some free demo versions, but they donot seem to work well.

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Pete LongTechnical ConsultantCommented:
File Recovery

When a file is deleted either from the Network, By a program or from the Command Line, is does not get put into the recycle bin. However the file is NOT erased, instead the information that points to the file is erased. By erasing the pointer, the file becomes "Invisible" to the Operating system. Using Third party software these files can be recovered.

NOTE: remove the offending Hard Drive and fit in in a working PC as a slave drive - Deleted files get overwritten FIRST so just installing recovery software can over-write them.

**********Freeware Recovery Tools**********

Deleted File Analysis

PC Inspector
(FAT 12/16/32 NTFS)

(Also have a Netware version - NOT FREE)

**********TrialWare Recovery Tools**********

Undelete 3.0 (30 Day trial available)
(NT/2K/XP) - Can run direct from the CD

File Recover

(FAT12/16/32 NTFS NTFS5 and Ext2FS)

Recover My Files

**********Shareware Recovery Tools**********

File Scavenger
(NT/2K/XP) - Supports Reformatted Volumes -Limited to 32Kb file size!

GetDataBack for FAT
(FAT) Works Even After FDisk and Format, Can run Over the network.

GetDataBack for NTFS
(NTFS) Works Even After FDisk and Format, Can run Over the network.

(FAT 12/16/32 NTFS) Runs From MMC Console

(FAT 12/16/32 NTFS) Runs from DOS Bootdisk

FinalData Plus

************Commercial Products************

File Restore ($39.00)

HDR Data Recovery ($485.00) Trail available

**********Good Link to More Info***********
Video Tutorial
You might be able to turn on auditing (in the policies, but probably only available to xp pro, not home) in order to get events like that logged, but you'd have to have done that prior to it having happened, and it won't be possible to get all the details which you'd probably want!

First check in your recycle bin, maybe the files are there!

I haven't tried recovery with freeware, but you can find out if things are recoverable using getdataback, then you'd have to pay for the software to actually restore the files
Hi There,

Below are Freeware PC Inspector File Recovery  and others  
which you may like to try to download and see if solve your problem
PC Inspector File Recovery is a data recovery program with support for FAT 12/16/32 and NTFS file systems. It recovers files with the original time and date stamp, and can optionally restore them to a network drive and can recover many files, even when a header entry is no longer available. On FAT systems, the programs finds partitions automatically, even if the boot sector or FAT has been erased or damaged. PC Inspector File Recovery offers an easy to use interface that will scan your drive and automatically make files that can be recovered available from a "Deleted" folder in an Explorer Style navigation tree.

Listed are 2  commerical Softwares which are very good recovery tool which you may also consider.

Dependingon your OS you format your drive...
GetDataBack for NTFS V3.01
Recover your files when the data is no longer accessible due to formatting, fdisk, virus attack, power or software failure. Get everything back even when the drive's partition table, boot record, Master File Table or root directory is lost or corrupt.

or GetDataBack for FAT V3.01
GetDataBack will help you retrieve your files if the hard drive's partition table, boot record, FAT, or root directory have been damaged by a virus, formatting, fdisk or power failure. GetDataBack can even recover your data when the drive is no longer recognized by Windows.

Also another good one that also reciver disk partitions etc
Acronis Disk Director Suite 10
Acronis Disk Director Suite 10.0 is a comprehensive workstation partition and disk management suite that combines a number of previous Acronis products into one solution:

 Acronis Partition Expert allows you to resize, move, copy, split, and merge partitions without losing your data
 Acronis OS Selector is a multi-boot software utility that allows you to install multiple operating systems on your PC
 Acronis Recovery Expert allows you to recover accidentally lost or deleted partitions
 Acronis Disk Editor is a disk drive repair tool that allows you to perform advanced operations on your hard disk drive, such as restoration of boot records and hexadecimal editing

Best of lucks



Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

dataminerAuthor Commented:
Hi all,

thanks for the quick reply. I followed imacgouf's link and found a "File Scavenger", which seems to perform fairly well. I could find almost all files deleted from today back to the year 2001, EXCEPT the files that I realy want to find!??
Perhaps I didnot really delete them?? But I cannot find them anymore on my harddisk. I guess if I did a "Cut & Paste", the original files should be deleted and thus should also be found by the recovery software.

I checked the recycle bin, my files are not there.

dataminerAuthor Commented:
or perhaps a virus is so intelligent that it immediately rewrites the files after it deleted them?
Use the "search" utility of windows to look for the files, as you might not have deleted them but rather moved them to some other place.
dataminerAuthor Commented:
I've searched the whole computer with different possible keywords that are contained in the name or content of the files, but could not find the files.
maybe you also renamed the files? or you moved the files to an external media like a USB HD or a writable CD?

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
dataminerAuthor Commented:
they are thousands of files which I cannot change their names or contents individually. I did not use any USB HD and there is no writable CD in  the drive.

My system works now quite unstable, during the time that I ask this question my computer crashed twice. I must completely shut the computer down and then restart to run it normally.

Could a virus or a hacker be the reason for the data lost?
dataminerAuthor Commented:
But I then wonder how did they do it so that the files can neither be found nor be recovered.

I recently have problem with the goold desktop which always gives error message like "google desktop cannot ?? successfully" or sth like that. Could this be the reson?
Files get written over when they are deleted and you don't immediately stop using the system. This overwriting can be random so some files will still be recoverable and others won't. Usually if there is a large contiguous space in the deleted area that would be used first when allocating diskspace to new files, so it is more likely that small files that were in fragmented areas on the disk can be recovered than large ones which weren't in the fragmented area.

Download the latest version of HijackThis

run it and save the log. Paste the log to the following website

Follow the following exactly:

At the bottom of the page you'll see a "ANALYZE" button. Click it and you will have an analysis of your log. Now a new button, "SAVE ANALYSIS" will show up at the bottom. Your analyzed log will be saved to a page on that homepage, of which you can post the URL here. I should then be able to see if there is any software causing problems.
dataminerAuthor Commented:
Dushan De SilvaTechnology ArchitectCommented:
Cherukuri30Service EngineerCommented:
REcover MyFiles software is the best to recover the deleted files even after re-formatting the drive or deleting the partition try this out

This is a trial software when you run this program it will show you all the deleted files and which can be recovered, in order to recover them you have to buy the license which will cost you 70$

I am not sure whether any freeware is available to retrieve the lost data. When you are running this software search for only those files you want to retrieve as u said textfiles, word docs etc. This is will make the search fast
Use hijackthis to remove the following:

R3 - URLSearchHook: (no name) - _{2C5AA40E-8814-4EB6-876E-7EFB8B3F9662} - (no file)
O2 - BHO: (no name) - {68AE6707-B217-7FC6-8207-6D557CAF2869} - C:\WINDOWS\System32\weyoih.dll (file missing)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Microsoft AOL Instant Messenger] MSAOL32.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKLM\..\RunServices: [Microsoft AOL Instant Messenger] MSAOL32.exe
O4 - HKCU\..\Run: [Microsoft AOL Instant Messenger] MSAOL32.exe
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O15 - Trusted Zone: * (HKLM)
O15 - Trusted IP range: (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} -
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Storage Software

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.