• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 186
  • Last Modified:

Did I loose my Data?

Greetings All,

On Nov-26, I used P2P LimeWire to search and download certain software.  After the download is complete which was in zipped file, I opened it to install, then all of a sudden everything in my Desktop (Files and Folders) were gone with the exception of "My Document" folder.  I didn’t find anything is the Recycle Bin.  My XP Pro got affected in the process and I ran MacAfee and caught that zipped file as "ipwins.exe" virus and got rid of it.  I reloaded XP again (without formatting) and selected "Repair" option and I got my XP running again.  I launched "System Restore" to previous date (the 25th of November) hoping to find my lost data.  After the restore, I found couple of folders but they were empty.  My questions are

1- Did I loose my data?
2- If Yes or No, is there any way to get it back?
3- I ran System Mechanic 6 Pro where there is an advanced feature to search and locate deleted files and folders, but without any luck at all, not even a single file or folder…any help?

Thanks a lot,,,
0
Pro-IT
Asked:
Pro-IT
  • 6
  • 5
  • 2
  • +1
1 Solution
 
PowerITCommented:
1: Probably
2: Maybe: use a recovery tool
3: But you already did. So that would be it. You could try other but the chances are very slim.

Lessons learned:
1: Use best practices: Least User Privilige, so don't run as administrator. Less chance of getting bitten.
2: don't trust anything you get form P2P.
3: always have a backup of crucial data and files on external carrier.

J.
0
 
Pro-ITAuthor Commented:
Oh My GOD !!!

plz plz plz plz...there should be a better way....how could it be that I these deleted items are not found the Recycle Bin? or correct me plz....
0
 
PowerITCommented:
Well, some remarks.
- ipwins.exe is adware or spyware. Not a real virus. So it's probably not what wiped your data.
- there are ways to delete files in such a way that they are not recoverable. There are tools who do just that, for security and privacy reasons. So yes it is possible. There are actually 3 levels of deleting: normal (to the recycle bin), deleting (like shift-del) which just changes a flag in the file system: this is the recoverable kind with tools like System Mechanic, wiping: overwrites the content original file several times and completely deletes the pointers in the filesystem.
- could have been a crash of your filesystem. Doing a repair install and
- please post the name of the software that you installed from limewire. It could be that: it's malware that wiped your desktop, but it could also be a bug in the application. If we know the application then we can look into that.


J.
0
 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

 
SoutieCommented:
first thing, do not copy anything on to that hard drive.

The reason for this is that when a file gets deleted all that happens is the operating system flags it as deleted, the physical bits are still on the drive and can _USUALLY_ be recovered.  If you write data on to the drive the data on the drive itself gets overwritten and recovering the data gets exponentially harder, if not altogether impossible.

Next step, get a data recovery tool like getdataback and see if the tool will allow you to recover the data.
http://www.runtime.org/gdb.htm

Failing that you could always take the drive to a data recovery specialist. The problem is this is usually very expensive and is a toss up as top whether the data is worth that much
0
 
PowerITCommented:
Oops, did not finish my 3-rd remark.
It should be: Doing a repair install and system restore changes a lot of data on your hard disk. It could have been recoverable before that, but not any more now.

J.
0
 
Pro-ITAuthor Commented:
Okay...lets see...I would like to thank you guys for your quick inputs...I went searching for matching case and I found s/w called "GetDataBack for NTFS" and still working on it and not yet finished...will update u once done...Thanks!
0
 
AdamRobinsonCommented:
You downloaded a zip file from Limewire, unpacked it, and ran an executable?

I can only guess you are pirating software.

If so, you got what you deserved.

If not, don't do that, man!  It's asking for bad, bad, bad, bad, bad trouble.

0
 
Pro-ITAuthor Commented:
Hey Adam..

Spare me your comments...will ya?....I am not to listen if i deserve this or that or whether or not it is pirating s/w...if u can help me in this, say so...otherwise, with all due respect, thank you dude! we are about to solve technical issues, not being judgemental...thank u.
0
 
SoutieCommented:
@ Pro-IT did the getdataback recovery tool work? where you able to save the data on the drive?
0
 
Pro-ITAuthor Commented:
Hi Soutie,

unfortunately, it didnt work...it showed many files and folders and in order to view them i had to download "DiskExplorer for NTFS" s/w which i had to locate in different drive which i did so...after it finished, it created many unrecognized files and each one is 650 MB and it showed my deleted files and folders but all are invalid.

Hi PowerIT,

 I really forgot the name of the s/w, but it was with the crack combined into one zipped file..so once i openned it, it wiped out my desktopn files and folders except my document folder and my XP became slow and hanging....so i had to repair by re-installing as i described in my first question.
0
 
PowerITCommented:
Then I'm afraid that no-one will be able to do anything for you. Even specialist in datarecovery like Ontrack, because there has been written a lot to that disk after the failure.
You could ask them but I think it would be a waste of many. They charge thousands - less when they fail to recover - so you'll have to choose if it's worth trying.

J.
0
 
Pro-ITAuthor Commented:
Hi PowerIT,

Yes I remembered the s/w i was downloading from LimeWire.  Actually, I was searching for Qurb Anti-Spam, and here is the exact name of the file (in zip format) which it did what it did:( [Super anti-spam] Qurb 2.1.203.0 setup + crack ).  It is only one file along with the crack, and the actual crack file was not there which looked odd to me but i was quick to open it which deleted or erased all my Desktop contents....plz help...thanks...  
0
 
PowerITCommented:
As I already mentioned: I'm convinced that you really are running out of options.
The name of the program does not matter any more.
Whether that deleted your files, or this was bad luck (crashed file system etc ...), trying recoveries which wrote to your disk makes it practically unfeasible to get your data back. That's what Diskexplorer for Ntfs (pirated again have you?) proved.
I don't know that software but after quickly reading up on it, I did not find any 'undelete' feature in the literature.
So, as your last resort try this: Restoration from http://www.snapfiles.com/get/restoration.html
That's my tool which I always have at hand for undeleting. And it's freeware (legal!). I have used it many times, also on flashcards from digital camera's where colleagues accidentally deleted photo's they thought they moved to other storage.
But as I said: the chases are slim.

J.
0
 
PowerITCommented:
Pro-IT,

I'm just interested if you gave restoration a try.
Even if I regarded the chances of finding somtehing back very slim.
Anyway, we did give it a try to help you. But not everything can be resolved.

J.
0

Featured Post

How to Use the Help Bell

Need to boost the visibility of your question for solutions? Use the Experts Exchange Help Bell to confirm priority levels and contact subject-matter experts for question attention.  Check out this how-to article for more information.

  • 6
  • 5
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now