Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Need help locating my files that were lost from the partition drive


  • Please log in to reply
9 replies to this topic

#1 Javaman21

Javaman21

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Local time:11:19 PM

Posted 27 February 2012 - 09:28 PM

Hi! This is a background of what happened to my laptop:

My hard drive has two partitions: C: and P:. C: looks normal, but P:, which has all of my files, is empty. Properties show that Capacity and Free Space are the same.

I tried to search a specific file that I know is saved in drive P: and it shows up under Recent Documents, together with the rest of my lost files. Only they are shortcuts. When I try to open one, an error message says, "The drive or network connection that the shortcut "filename" refers to is unavailable. Make sure that the disk is properly inserted or the network resource is available. And then try again.

I did a System Restore but nothing happened. I ran Malwarebytes, Spybot, SAS, RKill, TDSKiller, SystemLook, Unhide.exe by following what I found in your forums. They found several Trojans, Adware Tracking Cookie, Microsoft.WindowsSecurityCenter.FirewallOverride and Microsoft.WindowsSecurityCenter.AntiVirusOverride. So I followed the cleaning instructions, but it still did not bring back my files.

One thing I noticed in Malwarebytes. When I do a scan of drive P:/ it scans the C: drive instead.

I did the troubleshooting advised by boopme, then I was helped by m0le. After several scans, he finally gave me the ok that my laptop is clean and advised me to post here regarding my problem with the lost files.

When I open Drive P: it contains a Recycler Folder and a System Volume Information folder that I can't open. Basically, Drive P: doesn't contain anything.

Please help. I really need those files and I'm hoping that they are still in there somewhere, still hidden by the after effects of the virus. The last virus found is Win32/AutoRun.Hupigon.V worm. Thanks.

BC AdBot (Login to Remove)

 


#2 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:10:19 AM

Posted 27 February 2012 - 10:22 PM

Hi

I read your other threads and it looks like these were all missing before you started posting and it did not happen while you were going through the process of cleaning with the help here at this forum.

Can you give us any other information about what happened around the time that the files stopped being available?

An important question, since the partition still exists is were they deleted or formatted?

Or did in fact the entire P: partition disappear and you did something to bring it back?

James

#3 Javaman21

Javaman21
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Local time:11:19 PM

Posted 28 February 2012 - 12:43 AM

Hi James,

I did not really know what happened. I was working on my computer one day and then the next day there are no more file folders in drive P:. It's just empty except for the Recycler Folder and System Volume Information folder. The first thing I did is to search a file that I know is saved in that drive. The Search Results showed only shortcuts in the Recent Documents. When I checked further, all of my files are there, which usually means that the file was recently accessed/opened right? That's why it shows in Recent Documents. But that's impossible since some of the files were my backups from as far back as 2005 so I definitely did not open them days before.

Then I was able to download a software trial version of Restore My Files. I think I forgot to mention this before. Then I did a System Restore but nothing happened. So on and so forth.

Drive P: has been there the entire time, it never disappeared. Just the folders within.

Hope this can still be remedied. Thanks!

#4 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:10:19 AM

Posted 28 February 2012 - 01:34 AM

I do have a method for going about an attempted recovery but it is not simple and I have never walked someone through it in a forum. Tomorrow, I'll do it on a test machine so I can document the steps carefully and let you know how to do it in a manner that does not make it a 'do or die' proposition so that if it does not succeed, it does not remove further options.

Did you try the Restore My Files product? If you did what happened?

In the meantime someone else may have a solution also and will enter this thread with us.

James

#5 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:10:19 AM

Posted 28 February 2012 - 03:44 PM

My main concern in a recovery is how the files disappeared. If they were deleted and nothing has been done to the area of the disk they were on then you simply undelete them.

If they disapeared because of damage to the filesystem or drive or they have been scrambled or overwritten since being deleted, then you have to get more aggressive.

In your case, you don't know. Let's assume the best case scenario. They were deleted and have remained undisturbed.

Here is the easiest free thing for you to try.
Download copy of Recuva...
http://www.piriform.com/recuva
(when you install it make sure to uncheck any extra toolbars if you do not want them)

This will probably recover a ton of files but will probably not recover the directory structure so you will get back your data but it will be a chore to go through it all and get what is important out of it.

When you run Recuva.exe
Select OTHER for file type if you want to recover everything.
NEXT
Select 'In a specific location' and browse to your P: drive
NEXT
Check 'Enable Deep Scan'
START
Then wait for it to finish to see what it got that is in an 'Excellent' state.
Select the files that you wish to recover and choose a location to recover them to (preferrably not on the P: drive in case you want to perform a deeper scan or recover other files later)

That should do it if you have not had any other problems with the partition and have not overwritten it since the files were deleted.

Let us know if you have any problems or questions and how things turn out.

James

Edited by NeverSayDie, 28 February 2012 - 03:46 PM.


#6 Javaman21

Javaman21
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Local time:11:19 PM

Posted 28 February 2012 - 08:05 PM

Hi James! I'll give it a try when I have my laptop with me. Thanks! I'll let you know how it goes :)

#7 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:10:19 AM

Posted 28 February 2012 - 08:38 PM

I thought restoring folder structure was only in the paid version but I think that in the free version when you are in the screen to select which files to recover

Click OPTIONS
Click the ACTIONS tab
and if you see RESTORE FOLDER STRUCTURE
make sure it is checked and you should get your folders back in addition to the files that you choose to recover.

James

#8 Javaman21

Javaman21
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Local time:11:19 PM

Posted 01 March 2012 - 01:01 PM

Hi James, I tried recuva and it successfully identified my files. It shows that it is still in P:/ but it is inside a folder named "?". However when I tried to recover them it said, Error: Maximum path length exceeded. I tried saving in C: and in an external hard drive but it shows that error message. I didn't try saving in P: since you advised not to. Why do u think that's the case?

Anyway I'm glad to see that my files are still lurking in there somewhere. Thanks! :)

#9 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:10:19 AM

Posted 01 March 2012 - 01:15 PM

Good, looks like it was just a simple mysterious delete.

You might not be able to recover the directory structure then :(
Try unchecking RESTORE FOLDER STRUCTURE and see if it allows you to recover the individual files. You can test it by just trying one or two files first then go through and check all the most important ones to you.

As long as you do not write anything to P: you can keep going back to it to recover more of the files.

EDIT: If this becomes a serious issue for you, there is a potential workaround but it might be almost as difficult as getting the individual files you need and manually putting them in new folders.

James

Edited by NeverSayDie, 01 March 2012 - 01:24 PM.


#10 Javaman21

Javaman21
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Local time:11:19 PM

Posted 01 March 2012 - 01:40 PM

I tried several folders at a time without unchecking restore folder structure. It worked! Thanks a lot! I can now access the recovered files. :) some filenames changed though, they seemed truncated and has a "~" symbol. But I can live that and just rename if needed. Now I plan to just get all the important files before reformatting the whole thing.

I'm just consulting with a mod regarding another possible malware problem with the appearance of several folders and files named hotfixinstallerui.dll and eula.rtf. After that I'm good to go. Thanks!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users