Pro-IT
asked on
Did I loose my Data?
Greetings All,
On Nov-26, I used P2P LimeWire to search and download certain software. After the download is complete which was in zipped file, I opened it to install, then all of a sudden everything in my Desktop (Files and Folders) were gone with the exception of "My Document" folder. I didn’t find anything is the Recycle Bin. My XP Pro got affected in the process and I ran MacAfee and caught that zipped file as "ipwins.exe" virus and got rid of it. I reloaded XP again (without formatting) and selected "Repair" option and I got my XP running again. I launched "System Restore" to previous date (the 25th of November) hoping to find my lost data. After the restore, I found couple of folders but they were empty. My questions are
1- Did I loose my data?
2- If Yes or No, is there any way to get it back?
3- I ran System Mechanic 6 Pro where there is an advanced feature to search and locate deleted files and folders, but without any luck at all, not even a single file or folder…any help?
Thanks a lot,,,
On Nov-26, I used P2P LimeWire to search and download certain software. After the download is complete which was in zipped file, I opened it to install, then all of a sudden everything in my Desktop (Files and Folders) were gone with the exception of "My Document" folder. I didn’t find anything is the Recycle Bin. My XP Pro got affected in the process and I ran MacAfee and caught that zipped file as "ipwins.exe" virus and got rid of it. I reloaded XP again (without formatting) and selected "Repair" option and I got my XP running again. I launched "System Restore" to previous date (the 25th of November) hoping to find my lost data. After the restore, I found couple of folders but they were empty. My questions are
1- Did I loose my data?
2- If Yes or No, is there any way to get it back?
3- I ran System Mechanic 6 Pro where there is an advanced feature to search and locate deleted files and folders, but without any luck at all, not even a single file or folder…any help?
Thanks a lot,,,
ASKER
Oh My GOD !!!
plz plz plz plz...there should be a better way....how could it be that I these deleted items are not found the Recycle Bin? or correct me plz....
plz plz plz plz...there should be a better way....how could it be that I these deleted items are not found the Recycle Bin? or correct me plz....
Well, some remarks.
- ipwins.exe is adware or spyware. Not a real virus. So it's probably not what wiped your data.
- there are ways to delete files in such a way that they are not recoverable. There are tools who do just that, for security and privacy reasons. So yes it is possible. There are actually 3 levels of deleting: normal (to the recycle bin), deleting (like shift-del) which just changes a flag in the file system: this is the recoverable kind with tools like System Mechanic, wiping: overwrites the content original file several times and completely deletes the pointers in the filesystem.
- could have been a crash of your filesystem. Doing a repair install and
- please post the name of the software that you installed from limewire. It could be that: it's malware that wiped your desktop, but it could also be a bug in the application. If we know the application then we can look into that.
J.
- ipwins.exe is adware or spyware. Not a real virus. So it's probably not what wiped your data.
- there are ways to delete files in such a way that they are not recoverable. There are tools who do just that, for security and privacy reasons. So yes it is possible. There are actually 3 levels of deleting: normal (to the recycle bin), deleting (like shift-del) which just changes a flag in the file system: this is the recoverable kind with tools like System Mechanic, wiping: overwrites the content original file several times and completely deletes the pointers in the filesystem.
- could have been a crash of your filesystem. Doing a repair install and
- please post the name of the software that you installed from limewire. It could be that: it's malware that wiped your desktop, but it could also be a bug in the application. If we know the application then we can look into that.
J.
first thing, do not copy anything on to that hard drive.
The reason for this is that when a file gets deleted all that happens is the operating system flags it as deleted, the physical bits are still on the drive and can _USUALLY_ be recovered. If you write data on to the drive the data on the drive itself gets overwritten and recovering the data gets exponentially harder, if not altogether impossible.
Next step, get a data recovery tool like getdataback and see if the tool will allow you to recover the data.
http://www.runtime.org/gdb.htm
Failing that you could always take the drive to a data recovery specialist. The problem is this is usually very expensive and is a toss up as top whether the data is worth that much
The reason for this is that when a file gets deleted all that happens is the operating system flags it as deleted, the physical bits are still on the drive and can _USUALLY_ be recovered. If you write data on to the drive the data on the drive itself gets overwritten and recovering the data gets exponentially harder, if not altogether impossible.
Next step, get a data recovery tool like getdataback and see if the tool will allow you to recover the data.
http://www.runtime.org/gdb.htm
Failing that you could always take the drive to a data recovery specialist. The problem is this is usually very expensive and is a toss up as top whether the data is worth that much
Oops, did not finish my 3-rd remark.
It should be: Doing a repair install and system restore changes a lot of data on your hard disk. It could have been recoverable before that, but not any more now.
J.
It should be: Doing a repair install and system restore changes a lot of data on your hard disk. It could have been recoverable before that, but not any more now.
J.
ASKER
Okay...lets see...I would like to thank you guys for your quick inputs...I went searching for matching case and I found s/w called "GetDataBack for NTFS" and still working on it and not yet finished...will update u once done...Thanks!
You downloaded a zip file from Limewire, unpacked it, and ran an executable?
I can only guess you are pirating software.
If so, you got what you deserved.
If not, don't do that, man! It's asking for bad, bad, bad, bad, bad trouble.
I can only guess you are pirating software.
If so, you got what you deserved.
If not, don't do that, man! It's asking for bad, bad, bad, bad, bad trouble.
ASKER
Hey Adam..
Spare me your comments...will ya?....I am not to listen if i deserve this or that or whether or not it is pirating s/w...if u can help me in this, say so...otherwise, with all due respect, thank you dude! we are about to solve technical issues, not being judgemental...thank u.
Spare me your comments...will ya?....I am not to listen if i deserve this or that or whether or not it is pirating s/w...if u can help me in this, say so...otherwise, with all due respect, thank you dude! we are about to solve technical issues, not being judgemental...thank u.
@ Pro-IT did the getdataback recovery tool work? where you able to save the data on the drive?
ASKER
Hi Soutie,
unfortunately, it didnt work...it showed many files and folders and in order to view them i had to download "DiskExplorer for NTFS" s/w which i had to locate in different drive which i did so...after it finished, it created many unrecognized files and each one is 650 MB and it showed my deleted files and folders but all are invalid.
Hi PowerIT,
I really forgot the name of the s/w, but it was with the crack combined into one zipped file..so once i openned it, it wiped out my desktopn files and folders except my document folder and my XP became slow and hanging....so i had to repair by re-installing as i described in my first question.
unfortunately, it didnt work...it showed many files and folders and in order to view them i had to download "DiskExplorer for NTFS" s/w which i had to locate in different drive which i did so...after it finished, it created many unrecognized files and each one is 650 MB and it showed my deleted files and folders but all are invalid.
Hi PowerIT,
I really forgot the name of the s/w, but it was with the crack combined into one zipped file..so once i openned it, it wiped out my desktopn files and folders except my document folder and my XP became slow and hanging....so i had to repair by re-installing as i described in my first question.
Then I'm afraid that no-one will be able to do anything for you. Even specialist in datarecovery like Ontrack, because there has been written a lot to that disk after the failure.
You could ask them but I think it would be a waste of many. They charge thousands - less when they fail to recover - so you'll have to choose if it's worth trying.
J.
You could ask them but I think it would be a waste of many. They charge thousands - less when they fail to recover - so you'll have to choose if it's worth trying.
J.
ASKER
Hi PowerIT,
Yes I remembered the s/w i was downloading from LimeWire. Actually, I was searching for Qurb Anti-Spam, and here is the exact name of the file (in zip format) which it did what it did:( [Super anti-spam] Qurb 2.1.203.0 setup + crack ). It is only one file along with the crack, and the actual crack file was not there which looked odd to me but i was quick to open it which deleted or erased all my Desktop contents....plz help...thanks...
Yes I remembered the s/w i was downloading from LimeWire. Actually, I was searching for Qurb Anti-Spam, and here is the exact name of the file (in zip format) which it did what it did:( [Super anti-spam] Qurb 2.1.203.0 setup + crack ). It is only one file along with the crack, and the actual crack file was not there which looked odd to me but i was quick to open it which deleted or erased all my Desktop contents....plz help...thanks...
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Pro-IT,
I'm just interested if you gave restoration a try.
Even if I regarded the chances of finding somtehing back very slim.
Anyway, we did give it a try to help you. But not everything can be resolved.
J.
I'm just interested if you gave restoration a try.
Even if I regarded the chances of finding somtehing back very slim.
Anyway, we did give it a try to help you. But not everything can be resolved.
J.
2: Maybe: use a recovery tool
3: But you already did. So that would be it. You could try other but the chances are very slim.
Lessons learned:
1: Use best practices: Least User Privilige, so don't run as administrator. Less chance of getting bitten.
2: don't trust anything you get form P2P.
3: always have a backup of crucial data and files on external carrier.
J.