dataminer
asked on
Data recovery
Hi,
some important data on my harddisk have disappeared yesterday. I'm not sure if I deleted them accidently or any virus did it. Is it possible in Windows xp to show which operations (such as delete, create) have been performed during the last time?
The lost data are mostly .txt files and also some Word and PDF files. Do you know any powerful data recovery freeware to get the data back?
I've tried some free demo versions, but they donot seem to work well.
some important data on my harddisk have disappeared yesterday. I'm not sure if I deleted them accidently or any virus did it. Is it possible in Windows xp to show which operations (such as delete, create) have been performed during the last time?
The lost data are mostly .txt files and also some Word and PDF files. Do you know any powerful data recovery freeware to get the data back?
I've tried some free demo versions, but they donot seem to work well.
You might be able to turn on auditing (in the policies, but probably only available to xp pro, not home) in order to get events like that logged, but you'd have to have done that prior to it having happened, and it won't be possible to get all the details which you'd probably want!
First check in your recycle bin, maybe the files are there!
I haven't tried recovery with freeware, but you can find out if things are recoverable using getdataback, then you'd have to pay for the software to actually restore the files
http://runtime.org
First check in your recycle bin, maybe the files are there!
I haven't tried recovery with freeware, but you can find out if things are recoverable using getdataback, then you'd have to pay for the software to actually restore the files
http://runtime.org
Hi There,
Below are Freeware PC Inspector File Recovery and others
which you may like to try to download and see if solve your problem
http://www.snapfiles.com/Freeware/system/fwdatarecovery.html
PC Inspector File Recovery is a data recovery program with support for FAT 12/16/32 and NTFS file systems. It recovers files with the original time and date stamp, and can optionally restore them to a network drive and can recover many files, even when a header entry is no longer available. On FAT systems, the programs finds partitions automatically, even if the boot sector or FAT has been erased or damaged. PC Inspector File Recovery offers an easy to use interface that will scan your drive and automatically make files that can be recovered available from a "Deleted" folder in an Explorer Style navigation tree.
Otherwise,
Listed are 2 commerical Softwares which are very good recovery tool which you may also consider.
Dependingon your OS you format your drive...
(1)
GetDataBack for NTFS V3.01 http://www.runtime.org/products.htm
--------------------------
Recover your files when the data is no longer accessible due to formatting, fdisk, virus attack, power or software failure. Get everything back even when the drive's partition table, boot record, Master File Table or root directory is lost or corrupt.
or GetDataBack for FAT V3.01
--------------------------
GetDataBack will help you retrieve your files if the hard drive's partition table, boot record, FAT, or root directory have been damaged by a virus, formatting, fdisk or power failure. GetDataBack can even recover your data when the drive is no longer recognized by Windows.
(2)
Also another good one that also reciver disk partitions etc
Acronis Disk Director Suite 10
--------------------------
Acronis Disk Director Suite 10.0 is a comprehensive workstation partition and disk management suite that combines a number of previous Acronis products into one solution:
Acronis Partition Expert allows you to resize, move, copy, split, and merge partitions without losing your data
Acronis OS Selector is a multi-boot software utility that allows you to install multiple operating systems on your PC
Acronis Recovery Expert allows you to recover accidentally lost or deleted partitions
Acronis Disk Editor is a disk drive repair tool that allows you to perform advanced operations on your hard disk drive, such as restoration of boot records and hexadecimal editing
Best of lucks
.
Below are Freeware PC Inspector File Recovery and others
which you may like to try to download and see if solve your problem
http://www.snapfiles.com/Freeware/system/fwdatarecovery.html
PC Inspector File Recovery is a data recovery program with support for FAT 12/16/32 and NTFS file systems. It recovers files with the original time and date stamp, and can optionally restore them to a network drive and can recover many files, even when a header entry is no longer available. On FAT systems, the programs finds partitions automatically, even if the boot sector or FAT has been erased or damaged. PC Inspector File Recovery offers an easy to use interface that will scan your drive and automatically make files that can be recovered available from a "Deleted" folder in an Explorer Style navigation tree.
Otherwise,
Listed are 2 commerical Softwares which are very good recovery tool which you may also consider.
Dependingon your OS you format your drive...
(1)
GetDataBack for NTFS V3.01 http://www.runtime.org/products.htm
--------------------------
Recover your files when the data is no longer accessible due to formatting, fdisk, virus attack, power or software failure. Get everything back even when the drive's partition table, boot record, Master File Table or root directory is lost or corrupt.
or GetDataBack for FAT V3.01
--------------------------
GetDataBack will help you retrieve your files if the hard drive's partition table, boot record, FAT, or root directory have been damaged by a virus, formatting, fdisk or power failure. GetDataBack can even recover your data when the drive is no longer recognized by Windows.
(2)
Also another good one that also reciver disk partitions etc
Acronis Disk Director Suite 10
--------------------------
Acronis Disk Director Suite 10.0 is a comprehensive workstation partition and disk management suite that combines a number of previous Acronis products into one solution:
Acronis Partition Expert allows you to resize, move, copy, split, and merge partitions without losing your data
Acronis OS Selector is a multi-boot software utility that allows you to install multiple operating systems on your PC
Acronis Recovery Expert allows you to recover accidentally lost or deleted partitions
Acronis Disk Editor is a disk drive repair tool that allows you to perform advanced operations on your hard disk drive, such as restoration of boot records and hexadecimal editing
Best of lucks
.
ASKER
Hi all,
thanks for the quick reply. I followed imacgouf's link and found a "File Scavenger", which seems to perform fairly well. I could find almost all files deleted from today back to the year 2001, EXCEPT the files that I realy want to find!??
Perhaps I didnot really delete them?? But I cannot find them anymore on my harddisk. I guess if I did a "Cut & Paste", the original files should be deleted and thus should also be found by the recovery software.
I checked the recycle bin, my files are not there.
thanks for the quick reply. I followed imacgouf's link and found a "File Scavenger", which seems to perform fairly well. I could find almost all files deleted from today back to the year 2001, EXCEPT the files that I realy want to find!??
Perhaps I didnot really delete them?? But I cannot find them anymore on my harddisk. I guess if I did a "Cut & Paste", the original files should be deleted and thus should also be found by the recovery software.
I checked the recycle bin, my files are not there.
ASKER
or perhaps a virus is so intelligent that it immediately rewrites the files after it deleted them?
Use the "search" utility of windows to look for the files, as you might not have deleted them but rather moved them to some other place.
ASKER
I've searched the whole computer with different possible keywords that are contained in the name or content of the files, but could not find the files.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
they are thousands of files which I cannot change their names or contents individually. I did not use any USB HD and there is no writable CD in the drive.
My system works now quite unstable, during the time that I ask this question my computer crashed twice. I must completely shut the computer down and then restart to run it normally.
Could a virus or a hacker be the reason for the data lost?
My system works now quite unstable, during the time that I ask this question my computer crashed twice. I must completely shut the computer down and then restart to run it normally.
Could a virus or a hacker be the reason for the data lost?
ASKER
But I then wonder how did they do it so that the files can neither be found nor be recovered.
I recently have problem with the goold desktop which always gives error message like "google desktop cannot ?? successfully" or sth like that. Could this be the reson?
I recently have problem with the goold desktop which always gives error message like "google desktop cannot ?? successfully" or sth like that. Could this be the reson?
Files get written over when they are deleted and you don't immediately stop using the system. This overwriting can be random so some files will still be recoverable and others won't. Usually if there is a large contiguous space in the deleted area that would be used first when allocating diskspace to new files, so it is more likely that small files that were in fragmented areas on the disk can be recovered than large ones which weren't in the fragmented area.
Download the latest version of HijackThis
http://www.hijackthis.de/downloads
run it and save the log. Paste the log to the following website
http://www.hijackthis.de/en
Follow the following exactly:
At the bottom of the page you'll see a "ANALYZE" button. Click it and you will have an analysis of your log. Now a new button, "SAVE ANALYSIS" will show up at the bottom. Your analyzed log will be saved to a page on that homepage, of which you can post the URL here. I should then be able to see if there is any software causing problems.
Download the latest version of HijackThis
http://www.hijackthis.de/downloads
run it and save the log. Paste the log to the following website
http://www.hijackthis.de/en
Follow the following exactly:
At the bottom of the page you'll see a "ANALYZE" button. Click it and you will have an analysis of your log. Now a new button, "SAVE ANALYSIS" will show up at the bottom. Your analyzed log will be saved to a page on that homepage, of which you can post the URL here. I should then be able to see if there is any software causing problems.
ASKER
REcover MyFiles software is the best to recover the deleted files even after re-formatting the drive or deleting the partition try this out
http://download.getdata.com/RecoverMyFiles-Setup.exe
This is a trial software when you run this program it will show you all the deleted files and which can be recovered, in order to recover them you have to buy the license which will cost you 70$
I am not sure whether any freeware is available to retrieve the lost data. When you are running this software search for only those files you want to retrieve as u said textfiles, word docs etc. This is will make the search fast
http://download.getdata.com/RecoverMyFiles-Setup.exe
This is a trial software when you run this program it will show you all the deleted files and which can be recovered, in order to recover them you have to buy the license which will cost you 70$
I am not sure whether any freeware is available to retrieve the lost data. When you are running this software search for only those files you want to retrieve as u said textfiles, word docs etc. This is will make the search fast
Use hijackthis to remove the following:
R3 - URLSearchHook: (no name) - _{2C5AA40E-8814-4EB6-876E-
O2 - BHO: (no name) - {68AE6707-B217-7FC6-8207-6
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\reals
O4 - HKLM\..\Run: [Microsoft AOL Instant Messenger] MSAOL32.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4q
O4 - HKLM\..\RunServices: [Microsoft AOL Instant Messenger] MSAOL32.exe
O4 - HKCU\..\Run: [Microsoft AOL Instant Messenger] MSAOL32.exe
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted IP range: 64.127.104.144 (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-9
R3 - URLSearchHook: (no name) - _{2C5AA40E-8814-4EB6-876E-
O2 - BHO: (no name) - {68AE6707-B217-7FC6-8207-6
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\reals
O4 - HKLM\..\Run: [Microsoft AOL Instant Messenger] MSAOL32.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4q
O4 - HKLM\..\RunServices: [Microsoft AOL Instant Messenger] MSAOL32.exe
O4 - HKCU\..\Run: [Microsoft AOL Instant Messenger] MSAOL32.exe
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted IP range: 64.127.104.144 (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-9
When a file is deleted either from the Network, By a program or from the Command Line, is does not get put into the recycle bin. However the file is NOT erased, instead the information that points to the file is erased. By erasing the pointer, the file becomes "Invisible" to the Operating system. Using Third party software these files can be recovered.
NOTE: remove the offending Hard Drive and fit in in a working PC as a slave drive - Deleted files get overwritten FIRST so just installing recovery software can over-write them.
**********Freeware Recovery Tools**********
Deleted File Analysis http://www.execsoft.com/freeware/freeware.asp
(NT/2K/XP)
PC Inspector http://www.pcinspector.de/file_recovery/UK/welcome.htm
(FAT 12/16/32 NTFS)
OnTrack http://www.ontrack.co.uk/freesoftware/freesoftware.asp
(Also have a Netware version - NOT FREE)
**********TrialWare Recovery Tools**********
Undelete 3.0 http://www.executive.com/undelete/undelete.asp (30 Day trial available)
(NT/2K/XP) - Can run direct from the CD
File Recover http://www.zdnetindia.com/indya/downloads/desktop/info/10204365.html
(95/98/ME/NT/XP)
R-Undelete http://www.tucows.com/preview/254623.html
(FAT12/16/32 NTFS NTFS5 and Ext2FS)
Recover My Files http://www.tucows.com/preview/258313.html
**********Shareware Recovery Tools**********
File Scavenger http://www.webattack.com/features/filescavenger-704-421808.php
(NT/2K/XP) - Supports Reformatted Volumes -Limited to 32Kb file size!
GetDataBack for FAT http://www.webattack.com/get/getbackfat.shtml
(FAT) Works Even After FDisk and Format, Can run Over the network.
GetDataBack for NTFS http://www.webattack.com/get/getbacknt.shtml
(NTFS) Works Even After FDisk and Format, Can run Over the network.
Active@ UNDELETE http://www.webattack.com/get/activeundelete.shtml
(FAT 12/16/32 NTFS) Runs From MMC Console
Active@ UNERASER http://www.webattack.com/get/activeuneraser.shtml
(FAT 12/16/32 NTFS) Runs from DOS Bootdisk
FinalData Plus http://www.zdnet.de/downloads/programs/4/7/en10164547-wc.html
(95/98/ME/NT/XP)
************Commercial Products************
File Restore ($39.00)
http://www.winternals.com/products/repairandrecovery/filerestore.asp
HDR Data Recovery ($485.00) Trail available
http://www.sofotex.com/download/software/8412.html
**********Good Link to More Info***********
http://www.hard-disk-data-recovery.com/datarecovery-pages/data_ntfs_recovery_software.html
Video Tutorial http://www.thepcspy.com/tutorials/article.asp?TID=111