Solved

User Data Lost

Posted on 2011-03-16
13
580 Views
Last Modified: 2012-05-11
All the user data, in fact all of the user accounts on a pc running XP Home sp3 seem to have been lost. Instead of the folders within documents and settings all that appears when the hard drive is placed in another pc (or viewed via Knoppix live cd) is a small file that has the user account name on it.

I guess the formatting has been lost but is there anyway of getting things back as they were to recover the data?
0
Comment
Question by:alfaro
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 8
  • 4
13 Comments
 
LVL 4

Expert Comment

by:LeDaouk
ID: 35146286
0
 
LVL 4

Expert Comment

by:bitla
ID: 35146423
Recovery will not work always and data that can be recovered will less than 100%, but still there is a chance.

Two way can be done Manually and using tools.

Manually
=========

You might be lucky if you set or enable System Restore. If enabled follow these steps.

1.)Open My computer
2)Click Tool---> folder options--> view---> uncheck Hide Protected System Files
and also select Show Hidden Files and FOlders
3) Now open drive letter say D: find the System Volume Information and open it. Here in this folder you will have most of the data that has been deleted manually or accidenlty done or formated.

Using Tools
=========
TESTDISK-6.11.3

Read documenation before starting.

http://www.cgsecurity.org/wiki/TestDisk
donwload

You can also go with the link provided by LeDaouk.
0
 

Author Comment

by:alfaro
ID: 35146631
I've taken a look at the TESTDISK utility and it can actually see the user account and reports it as around 35gb in size. However, Windows just shows it as a file of a few kb's. Is there anyway to get access to this account "normally", ie. through Windows or am I going to have to recover the data somehow?
0
Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

 

Author Comment

by:alfaro
ID: 35146661
Running Recover My Files it found all the files I can already access but doesn't find the missing user account at all..
0
 

Author Comment

by:alfaro
ID: 35146712
Oops, my mistake. When I said it had found 35gb of data it turns out that I was misreading things.. It looks like it has can only see the same 35kb's of data in the user account file. The same as in Windows...

How can I restore Windows using the process you describe? I can access the System Volume Information and in it there are lots of files called RP followed by different numbers. Inside each are various .dll's. How do I go about restoring these?
0
 

Author Comment

by:alfaro
ID: 35146738
I think I know what you meant regarding the System Volume Information. If you mean copy the backed up registry files into system32\config, I have just tried that and Windows gets as far as the login screen and then stops, as before. This is presumably because the user account no longer exists. This also applies in safe mode when I try to boot into the administrator account..
0
 
LVL 4

Expert Comment

by:bitla
ID: 35147134
Sorry! I made a mistake. Its not SYSTEM VOlume Information. ITs RECYCLER

In RECYCLER you will have the files and data that has been deleted or lost.

Using TestDisk you retrive the files but not accounts.
0
 
LVL 4

Expert Comment

by:bitla
ID: 35147148
Once you backup/retrieve data try System Restore and check whether the accounts and settings are restored.

Regards
Bitla
0
 

Author Comment

by:alfaro
ID: 35147395
There's nothing in Recycler, probably because the user accounts weren't deleted as such. They just sort of disappeared..

The overall occupied size of the disk is still the same as it was before the user accounts were lost so the data is still there somewhere..
0
 

Accepted Solution

by:
alfaro earned 0 total points
ID: 35147477
Bingo... Using Tree Size Pro I saw that there was  an awful lot of data in the Erdoundocache folder. A bit of poking around and I found the entire user account...
0
 

Author Comment

by:alfaro
ID: 35147488
Sorry, I meant ErdUndoCache folder, of course...
0
 
LVL 4

Expert Comment

by:bitla
ID: 35147499
Good and all the best, thank you for sharing the info.
0
 

Author Closing Comment

by:alfaro
ID: 35205037
Good old ErdUndoCache folder...
0

Featured Post

Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

VM backups can be lost due to a number of reasons: accidental backup deletion, backup file corruption, disk failure, lost or stolen hardware, malicious attack, or due to some other undesired and unpredicted event. Thus, having more than one copy of …
Facing problems with you memory card? Cannot access your memory card? All stored data, images, videos are lost? If these are your questions...than this small article might help you out in retrieving your lost or inaccessible data.
In this Micro Tutorial viewers will learn how to use Boot Corrector from Paragon Rescue Kit Free to identify and fix the boot problems of Windows 7/8/2012R2 etc. As an example is used Windows 2012R2 which lost its active partition flag (often happen…
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question