Solved

Did I loose my Data?

Posted on 2006-11-28
17
174 Views
Last Modified: 2010-04-11
Greetings All,

On Nov-26, I used P2P LimeWire to search and download certain software.  After the download is complete which was in zipped file, I opened it to install, then all of a sudden everything in my Desktop (Files and Folders) were gone with the exception of "My Document" folder.  I didn’t find anything is the Recycle Bin.  My XP Pro got affected in the process and I ran MacAfee and caught that zipped file as "ipwins.exe" virus and got rid of it.  I reloaded XP again (without formatting) and selected "Repair" option and I got my XP running again.  I launched "System Restore" to previous date (the 25th of November) hoping to find my lost data.  After the restore, I found couple of folders but they were empty.  My questions are

1- Did I loose my data?
2- If Yes or No, is there any way to get it back?
3- I ran System Mechanic 6 Pro where there is an advanced feature to search and locate deleted files and folders, but without any luck at all, not even a single file or folder…any help?

Thanks a lot,,,
0
Comment
Question by:Pro-IT
  • 6
  • 5
  • 2
  • +1
17 Comments
 
LVL 18

Expert Comment

by:PowerIT
ID: 18026133
1: Probably
2: Maybe: use a recovery tool
3: But you already did. So that would be it. You could try other but the chances are very slim.

Lessons learned:
1: Use best practices: Least User Privilige, so don't run as administrator. Less chance of getting bitten.
2: don't trust anything you get form P2P.
3: always have a backup of crucial data and files on external carrier.

J.
0
 

Author Comment

by:Pro-IT
ID: 18026165
Oh My GOD !!!

plz plz plz plz...there should be a better way....how could it be that I these deleted items are not found the Recycle Bin? or correct me plz....
0
 
LVL 18

Expert Comment

by:PowerIT
ID: 18026228
Well, some remarks.
- ipwins.exe is adware or spyware. Not a real virus. So it's probably not what wiped your data.
- there are ways to delete files in such a way that they are not recoverable. There are tools who do just that, for security and privacy reasons. So yes it is possible. There are actually 3 levels of deleting: normal (to the recycle bin), deleting (like shift-del) which just changes a flag in the file system: this is the recoverable kind with tools like System Mechanic, wiping: overwrites the content original file several times and completely deletes the pointers in the filesystem.
- could have been a crash of your filesystem. Doing a repair install and
- please post the name of the software that you installed from limewire. It could be that: it's malware that wiped your desktop, but it could also be a bug in the application. If we know the application then we can look into that.


J.
0
 
LVL 4

Expert Comment

by:Soutie
ID: 18026234
first thing, do not copy anything on to that hard drive.

The reason for this is that when a file gets deleted all that happens is the operating system flags it as deleted, the physical bits are still on the drive and can _USUALLY_ be recovered.  If you write data on to the drive the data on the drive itself gets overwritten and recovering the data gets exponentially harder, if not altogether impossible.

Next step, get a data recovery tool like getdataback and see if the tool will allow you to recover the data.
http://www.runtime.org/gdb.htm

Failing that you could always take the drive to a data recovery specialist. The problem is this is usually very expensive and is a toss up as top whether the data is worth that much
0
 
LVL 18

Expert Comment

by:PowerIT
ID: 18026281
Oops, did not finish my 3-rd remark.
It should be: Doing a repair install and system restore changes a lot of data on your hard disk. It could have been recoverable before that, but not any more now.

J.
0
 

Author Comment

by:Pro-IT
ID: 18026843
Okay...lets see...I would like to thank you guys for your quick inputs...I went searching for matching case and I found s/w called "GetDataBack for NTFS" and still working on it and not yet finished...will update u once done...Thanks!
0
 
LVL 16

Expert Comment

by:AdamRobinson
ID: 18029719
You downloaded a zip file from Limewire, unpacked it, and ran an executable?

I can only guess you are pirating software.

If so, you got what you deserved.

If not, don't do that, man!  It's asking for bad, bad, bad, bad, bad trouble.

0
Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

 

Author Comment

by:Pro-IT
ID: 18035284
Hey Adam..

Spare me your comments...will ya?....I am not to listen if i deserve this or that or whether or not it is pirating s/w...if u can help me in this, say so...otherwise, with all due respect, thank you dude! we are about to solve technical issues, not being judgemental...thank u.
0
 
LVL 4

Expert Comment

by:Soutie
ID: 18035303
@ Pro-IT did the getdataback recovery tool work? where you able to save the data on the drive?
0
 

Author Comment

by:Pro-IT
ID: 18035401
Hi Soutie,

unfortunately, it didnt work...it showed many files and folders and in order to view them i had to download "DiskExplorer for NTFS" s/w which i had to locate in different drive which i did so...after it finished, it created many unrecognized files and each one is 650 MB and it showed my deleted files and folders but all are invalid.

Hi PowerIT,

 I really forgot the name of the s/w, but it was with the crack combined into one zipped file..so once i openned it, it wiped out my desktopn files and folders except my document folder and my XP became slow and hanging....so i had to repair by re-installing as i described in my first question.
0
 
LVL 18

Expert Comment

by:PowerIT
ID: 18035547
Then I'm afraid that no-one will be able to do anything for you. Even specialist in datarecovery like Ontrack, because there has been written a lot to that disk after the failure.
You could ask them but I think it would be a waste of many. They charge thousands - less when they fail to recover - so you'll have to choose if it's worth trying.

J.
0
 

Author Comment

by:Pro-IT
ID: 18062804
Hi PowerIT,

Yes I remembered the s/w i was downloading from LimeWire.  Actually, I was searching for Qurb Anti-Spam, and here is the exact name of the file (in zip format) which it did what it did:( [Super anti-spam] Qurb 2.1.203.0 setup + crack ).  It is only one file along with the crack, and the actual crack file was not there which looked odd to me but i was quick to open it which deleted or erased all my Desktop contents....plz help...thanks...  
0
 
LVL 18

Accepted Solution

by:
PowerIT earned 500 total points
ID: 18062958
As I already mentioned: I'm convinced that you really are running out of options.
The name of the program does not matter any more.
Whether that deleted your files, or this was bad luck (crashed file system etc ...), trying recoveries which wrote to your disk makes it practically unfeasible to get your data back. That's what Diskexplorer for Ntfs (pirated again have you?) proved.
I don't know that software but after quickly reading up on it, I did not find any 'undelete' feature in the literature.
So, as your last resort try this: Restoration from http://www.snapfiles.com/get/restoration.html
That's my tool which I always have at hand for undeleting. And it's freeware (legal!). I have used it many times, also on flashcards from digital camera's where colleagues accidentally deleted photo's they thought they moved to other storage.
But as I said: the chases are slim.

J.
0
 
LVL 18

Expert Comment

by:PowerIT
ID: 18202742
Pro-IT,

I'm just interested if you gave restoration a try.
Even if I regarded the chances of finding somtehing back very slim.
Anyway, we did give it a try to help you. But not everything can be resolved.

J.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now