Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

New Profile removed My Documents. Why?

Posted on 2011-10-03
10
Medium Priority
?
226 Views
Last Modified: 2012-05-12
Hi,
This is complicated to explain but simple in scope. Domain server ruined in Irene flood. On-site person tried to remove domain and set up same profile on a laptop previously joined to the domain. Irreplaceable docuement files in My docuemnts disappeared. I used several Undelete utilities to see if the files could be found. I pulled the drive out and ran it on a desktoip to avoid any more changes. They do not exist anywhere on the hard drive or as deleted files.

I don't expect to get them back, but I'm wondering how that could happen. They are not in a "deleted" state and not existing as real, active files.

I also had the folder backed up on an external drive. I was ordered to delete the particular folder for security purposes. I tried to run some undelete utilities on the external drive and could not find that folder either. Different deep scans  would find files with random numbers for file names, but no extensions, so I couldn't tell what they were or who they belonged to. There was no activity on the external hard drive since I deleted the folder in question yet I couldn't find it.
I used Digital Rescue Premium,Advanced Data Recovery, and Recover My Files.

To summarize: Created a new profile that wiped out My Documents, but not pst files in the application data folder of the profile. No evidence of them existing or existing as undeleted files with the folder structure intact. Also I deleted the same folder from an external drive, yet undelete utilities can't find the folder. Why?
0
Comment
Question by:MIkeRKaplan
  • 5
  • 4
10 Comments
 
LVL 66

Expert Comment

by:johnb6767
ID: 36904858
Only thing I can see is that they were possibly redirected to a network resource.....
0
 

Author Comment

by:MIkeRKaplan
ID: 36904901
No valid network share was mapped at the time. That's what the on-site guy was trying to fix!
0
 
LVL 17

Expert Comment

by:bigeven2002
ID: 36904956
Hello,

First of all, sorry to hear about flood.

As odd as it may seem, this happened to me as well in the past.  Windows XP will recreate a profile in the same space as the deleted profile on the hard disk.  Why I don't know, but that is what causes it to be unrecoverable.  But I had also lost my PST file in the process too.

Unfortunately there really is not a way to get it back without sending to data recovery specialists which could costs thousands.  But it would be worth it if the documents are that vital.

What the on-site person did was probably remove the computer from the domain and then restart the computer and then rejoin the domain and have you login.  This will cause the old profile to be overwritten and it's content location on the disk overwritten as well, hence why the recovery programs could not find it.

What should have happened was the support person should have logged into your machine as a local administrator to backup your documents before disjoining the domain.  Then, disjoin the domain but NOT restart the computer and then immediately rejoin the domain, and then restart.  This would have preserved your existing profile.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:MIkeRKaplan
ID: 36905064
OK. Receating the profile reuses the same disk space. That makes sense.

 How about the fact that I deleted the folder from an external hard drive that was not anywhere near that laptop and lost that folder.None of the undelete utilities could find the deleted folder. There was no activity on that external drive after deleting the folder, till I tried to recover it.
0
 
LVL 17

Expert Comment

by:bigeven2002
ID: 36906640
For the external drive, how were the files deleted?  Was just a simple select all press delete operation or was there more to it?  Did anyone else handle the drive besides you after the delete operation?  Such as did the security team perform a wipe delete on it?
0
 

Author Comment

by:MIkeRKaplan
ID: 36906745
I selected the folder, right-clicked and did a shift-delete. The drive was in my posession the whole time after that. No one else touched it.
0
 
LVL 17

Expert Comment

by:bigeven2002
ID: 36907777
This is very suprising.  What brand and model of external drive is it?
0
 

Author Comment

by:MIkeRKaplan
ID: 36910437
It's a Roswill enclosure with a seagate 300 GB PATA drive. So, I'm not crazy. The folder should be recoverable, but it just isn't there.
0
 
LVL 17

Accepted Solution

by:
bigeven2002 earned 2000 total points
ID: 36914216
I see.  Sorry I could not be of help.  The only thing I can suggest is trying a couple more recover utilities.  I know you tried a few already but at this point, I don't think it would hurt to try a couple more.  After that, it would have to go to a recovery specialist.
0
 

Author Closing Comment

by:MIkeRKaplan
ID: 36914258
I wasn't expecting to get the data back. I wanted to check with a peer on what is going on. Thanks for helping me.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many admins will agree: WSUS is is a nice invention but using it on the client side when updating a newly installed computer is still time consuming as you have to do several reboots and furthermore, the procedure of installing updates, rebooting a…
When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…

564 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question