Missing Profiles after rebooting

Is there any way to recover the information store on a local profile that was marked as Mandatory? Certain user saved very critical information on the desktop (a pst) ans after rebooting the PC all the info got missing or overwritten.

Any advise to recover this data?

Thanks,

yupinel14Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Member_2_49692Commented:
If you have a mandatory profile in place it will NOT save any data to the desktop also after the reboot it has been cleared from memory there is no way to recover this data at this point
0
Brian PiercePhotographerCommented:
You could try a file recovery tool such as undelete plus http://undelete-plus.com/ (free), or may favourate GetDataBack http://www.runtime.org/ (not free but good).

Whatever you use you will be best removing the drive from the users computer and slaving it into another as installing any software may permanently destroy the data you are attempting to recover.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Member_2_49692Commented:
here is more information about mandatoy user profles
http://support.microsoft.com/kb/307800

as microsoft says "Note: When a user with an assigned a mandatory profile logs off from a computer, any changes to the profile are lost"
0
10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

Member_2_49692Commented:
KCTS,

they are using a mandatory user profile which means all changes are lost inluding saving a file to the desktop it was never saved to the drive so there is no data recovery to do.
0
Jessie Gill, CISSPTechnical ArchitectCommented:
no possible way to recover since there is nothing to recover
0
Member_2_49692Commented:
yupinel14,

can you explain how were you were able to recover the data ? you aid you used a mandatory profile and the system was rebooted
0
yupinel14Author Commented:
A Junior Administrator set the profile as mandatory, and after rebooting the computer all the user data got lost. The first thing we tried was to locate the files logging in as Administrator, that did not work, then we called Microsoft, that did not work of course, at the end we went ahead and got a license of the GetDataBack for NTFS v2.3 (http://www.runtime.org). This app found all the files in about 5 minutes. Some of the files are corrupted, but we recover about 90% of the data.
0
Member_2_49692Commented:
I don't understand how that is possible when it is a mandatory profile and that by design is not supposed to allow you to write to the hard drive.

KCTS,

I am really curious now.... can you explain how this is possible because I've never heard of being able to recover data from a mandatory profile that by design is supposed to lock out the operating system from being changed (especially the desktop) considering the file was saved to the desktop and the pc rebooted this should have not been recoverable at all.
0
yupinel14Author Commented:
the change made on the computer was the following. The user has been using this computer for about a year with a standard profile, everything was being save on their default folders, (desktop, my documents, outlook, favorites, etc).

Yesterday, the Junior administrator changed the file extension of the NTUSER.DAT file to NTUSER.MAN, log off as administrator and the user logged back in with no problem (notice that the computer hasn't been rebooted yet). The user logged back in with no changes all his data was there, personal psts, folders, etc, everything; day is over, user turned off his computer, came back in the morning, logged in and ZAZ!!! everything was wiped out, a brand new profile.

When I ran this application with the HDD as slave on another machine, in about 5 minutes I was able to see a second user profile folder marked for deletion with must of the files in it.
0
Member_2_49692Commented:
OK that is why it worked then the data was already there. You didn't explain that in the intial question so technically speaking what myself and jessiepak said was correct. If this had ALWAYS been a mandatory profile there would have been no DATA recovery at all because nothing had ever been saved.

Had I known you meant that the user previously had a normal profile and then it got changed to a .man I would have suggested drive recovery software as there would have been something to recover now this all makes sense.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows OS

From novice to tech pro — start learning today.