Solved

Recover Deleted Files - Win XP on VMware Virtual Machine

Posted on 2012-03-10
4
964 Views
Last Modified: 2012-03-11
My System
My machine is XP SP3 running in a VMware Player virtual machine. The main OS is Ubuntu Linux 10.04 installed on a 2-disk mirrored (not striped) RAID.

Background
I deleted a user from Windows User Manager then found out I needed the outlook.pst file.

I need to recover the outlook.pst file if the data is still on the hard disk.

Question
Perhaps it is best to try to a recovery tool that runs from within Windows XP. In that case, what software do you recommend?  Please include the best free and paid tools that you are familiar with.

I hope it does not require that I recover this file from outside the Virtual Machine, say from the Linux box, or from a bootable CD-ROM. If so, what tools do you recommend for that?

Detailed Description
Deleted User From Windows XP User Manager

I removed the user intentionally, thinking I had a backup of the files. Turns out I did not, so now I need to recover my Outlook email .pst and settings files.

So the outlook.pst file, if viewed from the Linux OS, is inside the VMware image file, .vmdk.  Otherwise, it is visible from the Windows XP virtual machine in the folder, C:\Documents and Settings\<user>\Local Settings\Application Data\Microsoft\Outlook

The data files are here, C:\Documents and Settings\<user>\Application Data\Microsoft\Outlook

Question
Is there an undelete tool that allows me to access the data for these files?

Is there a tool I can install on another machine on the network? Or do I need to create a boot disk? Either way, is it correct that I will need to view the file from the Linux OS.

The only way to view the recovered files from within the windows virtual machine is to install the software while running the Windows virtual machine. Is there any way to avoid overwriting the data that I want to recover?
0
Comment
Question by:WizeOwl
4 Comments
 
LVL 47

Assisted Solution

by:dlethe
dlethe earned 100 total points
Comment Utility
Forget it. The file is gone. At best with some forensic software you can find chunks of it, but absolutely no way is the file going to be there.

The .vmdk isn't a contiguous chunk of blocks, so when file was deleted, the blocks that it used would effectively be moved to outside of the .vmdk, somewhere in the LINUX file system, so no way could a windows-based product even be able to access where the chunks of files were moved to.

Sorry, 100% data loss.  Best you could hope for is to get very small chunks of it that you couldn't possibly, or anybody could possibly put together, and it gets worse every second the linux system is turned on.
0
 
LVL 70

Accepted Solution

by:
garycase earned 400 total points
Comment Utility
First of all, as with any disk you need to recover data from, STOP !!   Do NOT power on that virtual machine again.

It IS true that this being a virtual machine complicates (and probably reduces the likelihood of success) the recovery process ... but IF there's any chance of recovery, it's FAR more likely to succeed if you STOP using the machine.

Do the following:

On another virtual machine (create one if you don't have one to use), add as a 2nd hard drive the virtual disk that you need to recover the file from.     This is the virtual machine equivalent of removing a disk from one system and attaching it to another.

Now install a good recovery package on that other machine (e.g. GetDataBack, Easy Recovery Pro, Recuva, etc.) and run it against the 2nd drive.    If the file is recoverable, that should let you do so.    Note:   BEFORE you run the recovery package, change the file view options in Windows Explorer to see both hidden and protected system files ... and "look" at the 2nd drive.    There's a chance the old tree wasn't actually deleted ... if that's the case you'll then be able to simply "see" the files without the need for recovery software.   But the main thing is to do everything from another system, with the drive attached as a secondary drive that's not in use for any other purpose.

Hint:   Perhaps the FIRST thing you should do is simply copy the virtual hard drive (the .vmdk file) ... and rename it.  (Do this with the VM shut down so the file isn't in use).    That freezes the state of the drive -- so if you happen to do something that writes to the drive, you can simply copy it back and it will be exactly as it was.
0
 
LVL 23

Expert Comment

by:Nagendra Pratap Singh
Comment Utility
I second what  garycase says.

Just make a copy of the folder containing the .vmdk before you try utilities in the VM or the temporary VM where you will make this a secondary disk.

Keep the original folder in a safe place. If the vmdk are safe then you can play with the copies forever.

http://lifehacker.com/393084/how-to-recover-deleted-files-with-free-software
0
 

Author Closing Comment

by:WizeOwl
Comment Utility
Thanks for your suggestions.

Most of the email is from Gmail, and I have a backup of my virtual machine that is 3 weeks old with the old user still on it.  So, I have reverted back to the old pst files, and I will download the old emails from Gmail and sort through them.
0

Featured Post

Google Storage: Standard vs. Nearline vs. Coldline

Google Cloud Storage has a number of classes to choose from. Although there are a lot in common, they vary in price and usage terms. This post explains Google Cloud Storage classes and helps to understand which  one to choose.

Join & Write a Comment

Set OWA language and time zone in Exchange for individuals, all users or per database.
If you don't know how to downgrade, my instructions below should be helpful.
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now