New Profile removed My Documents. Why?
Hi,
This is complicated to explain but simple in scope. Domain server ruined in Irene flood. On-site person tried to remove domain and set up same profile on a laptop previously joined to the domain. Irreplaceable docuement files in My docuemnts disappeared. I used several Undelete utilities to see if the files could be found. I pulled the drive out and ran it on a desktoip to avoid any more changes. They do not exist anywhere on the hard drive or as deleted files.
I don't expect to get them back, but I'm wondering how that could happen. They are not in a "deleted" state and not existing as real, active files.
I also had the folder backed up on an external drive. I was ordered to delete the particular folder for security purposes. I tried to run some undelete utilities on the external drive and could not find that folder either. Different deep scans would find files with random numbers for file names, but no extensions, so I couldn't tell what they were or who they belonged to. There was no activity on the external hard drive since I deleted the folder in question yet I couldn't find it.
I used Digital Rescue Premium,Advanced Data Recovery, and Recover My Files.
To summarize: Created a new profile that wiped out My Documents, but not pst files in the application data folder of the profile. No evidence of them existing or existing as undeleted files with the folder structure intact. Also I deleted the same folder from an external drive, yet undelete utilities can't find the folder. Why?
This is complicated to explain but simple in scope. Domain server ruined in Irene flood. On-site person tried to remove domain and set up same profile on a laptop previously joined to the domain. Irreplaceable docuement files in My docuemnts disappeared. I used several Undelete utilities to see if the files could be found. I pulled the drive out and ran it on a desktoip to avoid any more changes. They do not exist anywhere on the hard drive or as deleted files.
I don't expect to get them back, but I'm wondering how that could happen. They are not in a "deleted" state and not existing as real, active files.
I also had the folder backed up on an external drive. I was ordered to delete the particular folder for security purposes. I tried to run some undelete utilities on the external drive and could not find that folder either. Different deep scans would find files with random numbers for file names, but no extensions, so I couldn't tell what they were or who they belonged to. There was no activity on the external hard drive since I deleted the folder in question yet I couldn't find it.
I used Digital Rescue Premium,Advanced Data Recovery, and Recover My Files.
To summarize: Created a new profile that wiped out My Documents, but not pst files in the application data folder of the profile. No evidence of them existing or existing as undeleted files with the folder structure intact. Also I deleted the same folder from an external drive, yet undelete utilities can't find the folder. Why?
johnb6767
Only thing I can see is that they were possibly redirected to a network resource.....
ASKER
No valid network share was mapped at the time. That's what the on-site guy was trying to fix!
Hello,
First of all, sorry to hear about flood.
As odd as it may seem, this happened to me as well in the past. Windows XP will recreate a profile in the same space as the deleted profile on the hard disk. Why I don't know, but that is what causes it to be unrecoverable. But I had also lost my PST file in the process too.
Unfortunately there really is not a way to get it back without sending to data recovery specialists which could costs thousands. But it would be worth it if the documents are that vital.
What the on-site person did was probably remove the computer from the domain and then restart the computer and then rejoin the domain and have you login. This will cause the old profile to be overwritten and it's content location on the disk overwritten as well, hence why the recovery programs could not find it.
What should have happened was the support person should have logged into your machine as a local administrator to backup your documents before disjoining the domain. Then, disjoin the domain but NOT restart the computer and then immediately rejoin the domain, and then restart. This would have preserved your existing profile.
First of all, sorry to hear about flood.
As odd as it may seem, this happened to me as well in the past. Windows XP will recreate a profile in the same space as the deleted profile on the hard disk. Why I don't know, but that is what causes it to be unrecoverable. But I had also lost my PST file in the process too.
Unfortunately there really is not a way to get it back without sending to data recovery specialists which could costs thousands. But it would be worth it if the documents are that vital.
What the on-site person did was probably remove the computer from the domain and then restart the computer and then rejoin the domain and have you login. This will cause the old profile to be overwritten and it's content location on the disk overwritten as well, hence why the recovery programs could not find it.
What should have happened was the support person should have logged into your machine as a local administrator to backup your documents before disjoining the domain. Then, disjoin the domain but NOT restart the computer and then immediately rejoin the domain, and then restart. This would have preserved your existing profile.
ASKER
OK. Receating the profile reuses the same disk space. That makes sense.
How about the fact that I deleted the folder from an external hard drive that was not anywhere near that laptop and lost that folder.None of the undelete utilities could find the deleted folder. There was no activity on that external drive after deleting the folder, till I tried to recover it.
How about the fact that I deleted the folder from an external hard drive that was not anywhere near that laptop and lost that folder.None of the undelete utilities could find the deleted folder. There was no activity on that external drive after deleting the folder, till I tried to recover it.
For the external drive, how were the files deleted? Was just a simple select all press delete operation or was there more to it? Did anyone else handle the drive besides you after the delete operation? Such as did the security team perform a wipe delete on it?
ASKER
I selected the folder, right-clicked and did a shift-delete. The drive was in my posession the whole time after that. No one else touched it.
This is very suprising. What brand and model of external drive is it?
ASKER
It's a Roswill enclosure with a seagate 300 GB PATA drive. So, I'm not crazy. The folder should be recoverable, but it just isn't there.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I wasn't expecting to get the data back. I wanted to check with a peer on what is going on. Thanks for helping me.