• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1093
  • Last Modified:

Recover Deleted Files - Win XP on VMware Virtual Machine

My System
My machine is XP SP3 running in a VMware Player virtual machine. The main OS is Ubuntu Linux 10.04 installed on a 2-disk mirrored (not striped) RAID.

Background
I deleted a user from Windows User Manager then found out I needed the outlook.pst file.

I need to recover the outlook.pst file if the data is still on the hard disk.

Question
Perhaps it is best to try to a recovery tool that runs from within Windows XP. In that case, what software do you recommend?  Please include the best free and paid tools that you are familiar with.

I hope it does not require that I recover this file from outside the Virtual Machine, say from the Linux box, or from a bootable CD-ROM. If so, what tools do you recommend for that?

Detailed Description
Deleted User From Windows XP User Manager

I removed the user intentionally, thinking I had a backup of the files. Turns out I did not, so now I need to recover my Outlook email .pst and settings files.

So the outlook.pst file, if viewed from the Linux OS, is inside the VMware image file, .vmdk.  Otherwise, it is visible from the Windows XP virtual machine in the folder, C:\Documents and Settings\<user>\Local Settings\Application Data\Microsoft\Outlook

The data files are here, C:\Documents and Settings\<user>\Application Data\Microsoft\Outlook

Question
Is there an undelete tool that allows me to access the data for these files?

Is there a tool I can install on another machine on the network? Or do I need to create a boot disk? Either way, is it correct that I will need to view the file from the Linux OS.

The only way to view the recovered files from within the windows virtual machine is to install the software while running the Windows virtual machine. Is there any way to avoid overwriting the data that I want to recover?
0
WizeOwl
Asked:
WizeOwl
2 Solutions
 
DavidCommented:
Forget it. The file is gone. At best with some forensic software you can find chunks of it, but absolutely no way is the file going to be there.

The .vmdk isn't a contiguous chunk of blocks, so when file was deleted, the blocks that it used would effectively be moved to outside of the .vmdk, somewhere in the LINUX file system, so no way could a windows-based product even be able to access where the chunks of files were moved to.

Sorry, 100% data loss.  Best you could hope for is to get very small chunks of it that you couldn't possibly, or anybody could possibly put together, and it gets worse every second the linux system is turned on.
0
 
garycaseCommented:
First of all, as with any disk you need to recover data from, STOP !!   Do NOT power on that virtual machine again.

It IS true that this being a virtual machine complicates (and probably reduces the likelihood of success) the recovery process ... but IF there's any chance of recovery, it's FAR more likely to succeed if you STOP using the machine.

Do the following:

On another virtual machine (create one if you don't have one to use), add as a 2nd hard drive the virtual disk that you need to recover the file from.     This is the virtual machine equivalent of removing a disk from one system and attaching it to another.

Now install a good recovery package on that other machine (e.g. GetDataBack, Easy Recovery Pro, Recuva, etc.) and run it against the 2nd drive.    If the file is recoverable, that should let you do so.    Note:   BEFORE you run the recovery package, change the file view options in Windows Explorer to see both hidden and protected system files ... and "look" at the 2nd drive.    There's a chance the old tree wasn't actually deleted ... if that's the case you'll then be able to simply "see" the files without the need for recovery software.   But the main thing is to do everything from another system, with the drive attached as a secondary drive that's not in use for any other purpose.

Hint:   Perhaps the FIRST thing you should do is simply copy the virtual hard drive (the .vmdk file) ... and rename it.  (Do this with the VM shut down so the file isn't in use).    That freezes the state of the drive -- so if you happen to do something that writes to the drive, you can simply copy it back and it will be exactly as it was.
0
 
Nagendra Pratap SinghCommented:
I second what  garycase says.

Just make a copy of the folder containing the .vmdk before you try utilities in the VM or the temporary VM where you will make this a secondary disk.

Keep the original folder in a safe place. If the vmdk are safe then you can play with the copies forever.

http://lifehacker.com/393084/how-to-recover-deleted-files-with-free-software
0
 
WizeOwlAuthor Commented:
Thanks for your suggestions.

Most of the email is from Gmail, and I have a backup of my virtual machine that is 3 weeks old with the old user still on it.  So, I have reverted back to the old pst files, and I will download the old emails from Gmail and sort through them.
0

Featured Post

Configuration Guide and Best Practices

Read the guide to learn how to orchestrate Data ONTAP, create application-consistent backups and enable fast recovery from NetApp storage snapshots. Version 9.5 also contains performance and scalability enhancements to meet the needs of the largest enterprise environments.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now