[Last Call] Learn about multicloud storage options and how to improve your company's cloud strategy. Register Now

x
?
Solved

Recover Deleted Files - Win XP on VMware Virtual Machine

Posted on 2012-03-10
4
Medium Priority
?
1,078 Views
Last Modified: 2012-03-11
My System
My machine is XP SP3 running in a VMware Player virtual machine. The main OS is Ubuntu Linux 10.04 installed on a 2-disk mirrored (not striped) RAID.

Background
I deleted a user from Windows User Manager then found out I needed the outlook.pst file.

I need to recover the outlook.pst file if the data is still on the hard disk.

Question
Perhaps it is best to try to a recovery tool that runs from within Windows XP. In that case, what software do you recommend?  Please include the best free and paid tools that you are familiar with.

I hope it does not require that I recover this file from outside the Virtual Machine, say from the Linux box, or from a bootable CD-ROM. If so, what tools do you recommend for that?

Detailed Description
Deleted User From Windows XP User Manager

I removed the user intentionally, thinking I had a backup of the files. Turns out I did not, so now I need to recover my Outlook email .pst and settings files.

So the outlook.pst file, if viewed from the Linux OS, is inside the VMware image file, .vmdk.  Otherwise, it is visible from the Windows XP virtual machine in the folder, C:\Documents and Settings\<user>\Local Settings\Application Data\Microsoft\Outlook

The data files are here, C:\Documents and Settings\<user>\Application Data\Microsoft\Outlook

Question
Is there an undelete tool that allows me to access the data for these files?

Is there a tool I can install on another machine on the network? Or do I need to create a boot disk? Either way, is it correct that I will need to view the file from the Linux OS.

The only way to view the recovered files from within the windows virtual machine is to install the software while running the Windows virtual machine. Is there any way to avoid overwriting the data that I want to recover?
0
Comment
Question by:WizeOwl
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 47

Assisted Solution

by:David
David earned 400 total points
ID: 37706179
Forget it. The file is gone. At best with some forensic software you can find chunks of it, but absolutely no way is the file going to be there.

The .vmdk isn't a contiguous chunk of blocks, so when file was deleted, the blocks that it used would effectively be moved to outside of the .vmdk, somewhere in the LINUX file system, so no way could a windows-based product even be able to access where the chunks of files were moved to.

Sorry, 100% data loss.  Best you could hope for is to get very small chunks of it that you couldn't possibly, or anybody could possibly put together, and it gets worse every second the linux system is turned on.
0
 
LVL 70

Accepted Solution

by:
garycase earned 1600 total points
ID: 37706205
First of all, as with any disk you need to recover data from, STOP !!   Do NOT power on that virtual machine again.

It IS true that this being a virtual machine complicates (and probably reduces the likelihood of success) the recovery process ... but IF there's any chance of recovery, it's FAR more likely to succeed if you STOP using the machine.

Do the following:

On another virtual machine (create one if you don't have one to use), add as a 2nd hard drive the virtual disk that you need to recover the file from.     This is the virtual machine equivalent of removing a disk from one system and attaching it to another.

Now install a good recovery package on that other machine (e.g. GetDataBack, Easy Recovery Pro, Recuva, etc.) and run it against the 2nd drive.    If the file is recoverable, that should let you do so.    Note:   BEFORE you run the recovery package, change the file view options in Windows Explorer to see both hidden and protected system files ... and "look" at the 2nd drive.    There's a chance the old tree wasn't actually deleted ... if that's the case you'll then be able to simply "see" the files without the need for recovery software.   But the main thing is to do everything from another system, with the drive attached as a secondary drive that's not in use for any other purpose.

Hint:   Perhaps the FIRST thing you should do is simply copy the virtual hard drive (the .vmdk file) ... and rename it.  (Do this with the VM shut down so the file isn't in use).    That freezes the state of the drive -- so if you happen to do something that writes to the drive, you can simply copy it back and it will be exactly as it was.
0
 
LVL 24

Expert Comment

by:Nagendra Pratap Singh
ID: 37706610
I second what  garycase says.

Just make a copy of the folder containing the .vmdk before you try utilities in the VM or the temporary VM where you will make this a secondary disk.

Keep the original folder in a safe place. If the vmdk are safe then you can play with the copies forever.

http://lifehacker.com/393084/how-to-recover-deleted-files-with-free-software
0
 

Author Closing Comment

by:WizeOwl
ID: 37707683
Thanks for your suggestions.

Most of the email is from Gmail, and I have a backup of my virtual machine that is 3 weeks old with the old user still on it.  So, I have reverted back to the old pst files, and I will download the old emails from Gmail and sort through them.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You need to know the location of the Office templates folder, so that when you create new templates, they are saved to that location, and thus are available for selection when creating new documents.  The steps to find the Templates folder path are …
Changing a few Outlook Options can help keep you organized!
This tutorial will walk an individual through the process of configuring basic necessities in order to use the 2010 version of Data Protection Manager. These include storage, agents, and protection jobs. Launch Data Protection Manager from the deskt…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

650 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question