Solved

Recover Deleted Files - Win XP on VMware Virtual Machine

Posted on 2012-03-10
4
995 Views
Last Modified: 2012-03-11
My System
My machine is XP SP3 running in a VMware Player virtual machine. The main OS is Ubuntu Linux 10.04 installed on a 2-disk mirrored (not striped) RAID.

Background
I deleted a user from Windows User Manager then found out I needed the outlook.pst file.

I need to recover the outlook.pst file if the data is still on the hard disk.

Question
Perhaps it is best to try to a recovery tool that runs from within Windows XP. In that case, what software do you recommend?  Please include the best free and paid tools that you are familiar with.

I hope it does not require that I recover this file from outside the Virtual Machine, say from the Linux box, or from a bootable CD-ROM. If so, what tools do you recommend for that?

Detailed Description
Deleted User From Windows XP User Manager

I removed the user intentionally, thinking I had a backup of the files. Turns out I did not, so now I need to recover my Outlook email .pst and settings files.

So the outlook.pst file, if viewed from the Linux OS, is inside the VMware image file, .vmdk.  Otherwise, it is visible from the Windows XP virtual machine in the folder, C:\Documents and Settings\<user>\Local Settings\Application Data\Microsoft\Outlook

The data files are here, C:\Documents and Settings\<user>\Application Data\Microsoft\Outlook

Question
Is there an undelete tool that allows me to access the data for these files?

Is there a tool I can install on another machine on the network? Or do I need to create a boot disk? Either way, is it correct that I will need to view the file from the Linux OS.

The only way to view the recovered files from within the windows virtual machine is to install the software while running the Windows virtual machine. Is there any way to avoid overwriting the data that I want to recover?
0
Comment
Question by:WizeOwl
4 Comments
 
LVL 47

Assisted Solution

by:dlethe
dlethe earned 100 total points
ID: 37706179
Forget it. The file is gone. At best with some forensic software you can find chunks of it, but absolutely no way is the file going to be there.

The .vmdk isn't a contiguous chunk of blocks, so when file was deleted, the blocks that it used would effectively be moved to outside of the .vmdk, somewhere in the LINUX file system, so no way could a windows-based product even be able to access where the chunks of files were moved to.

Sorry, 100% data loss.  Best you could hope for is to get very small chunks of it that you couldn't possibly, or anybody could possibly put together, and it gets worse every second the linux system is turned on.
0
 
LVL 70

Accepted Solution

by:
garycase earned 400 total points
ID: 37706205
First of all, as with any disk you need to recover data from, STOP !!   Do NOT power on that virtual machine again.

It IS true that this being a virtual machine complicates (and probably reduces the likelihood of success) the recovery process ... but IF there's any chance of recovery, it's FAR more likely to succeed if you STOP using the machine.

Do the following:

On another virtual machine (create one if you don't have one to use), add as a 2nd hard drive the virtual disk that you need to recover the file from.     This is the virtual machine equivalent of removing a disk from one system and attaching it to another.

Now install a good recovery package on that other machine (e.g. GetDataBack, Easy Recovery Pro, Recuva, etc.) and run it against the 2nd drive.    If the file is recoverable, that should let you do so.    Note:   BEFORE you run the recovery package, change the file view options in Windows Explorer to see both hidden and protected system files ... and "look" at the 2nd drive.    There's a chance the old tree wasn't actually deleted ... if that's the case you'll then be able to simply "see" the files without the need for recovery software.   But the main thing is to do everything from another system, with the drive attached as a secondary drive that's not in use for any other purpose.

Hint:   Perhaps the FIRST thing you should do is simply copy the virtual hard drive (the .vmdk file) ... and rename it.  (Do this with the VM shut down so the file isn't in use).    That freezes the state of the drive -- so if you happen to do something that writes to the drive, you can simply copy it back and it will be exactly as it was.
0
 
LVL 23

Expert Comment

by:Nagendra Pratap Singh
ID: 37706610
I second what  garycase says.

Just make a copy of the folder containing the .vmdk before you try utilities in the VM or the temporary VM where you will make this a secondary disk.

Keep the original folder in a safe place. If the vmdk are safe then you can play with the copies forever.

http://lifehacker.com/393084/how-to-recover-deleted-files-with-free-software
0
 

Author Closing Comment

by:WizeOwl
ID: 37707683
Thanks for your suggestions.

Most of the email is from Gmail, and I have a backup of my virtual machine that is 3 weeks old with the old user still on it.  So, I have reverted back to the old pst files, and I will download the old emails from Gmail and sort through them.
0

Featured Post

The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Are you unable to connect or configure Hotmail email account in Microsoft Outlook 2010, 2007? Or Outlook.com emails are not downloading to Outlook? Lets’ see the problem and resolve Outlook Connector error syncing folder hierarchy (0x8004102A).
Large Outlook files lead to various unwanted errors and corruption issues. Furthermore, large outlook files can also make Outlook take longer to start-up, search, navigate, and shut-down. So, In this article, i will discuss a method to make your Out…
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
This tutorial will walk an individual through the process of installing of Data Protection Manager on a server running Windows Server 2012 R2, including the prerequisites. Microsoft .Net 3.5 is required. To install this feature, go to Server Manager…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question