Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

almost ALL of my pics were delete, by something unknown


  • Please log in to reply
8 replies to this topic

#1 FlyerX

FlyerX

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Local time:11:11 AM

Posted 07 May 2012 - 04:41 PM

this is the resume:

The files ARE there but they are kind of "hidden", in a strange way that can not be viewed, unhiden, restore or whatever with "unhide softwares, i can not even see it from linux.

BUT they can be viewed with ANY recovery software, the prolem of using the recovery software is that they are too many, duplicates, and the jpgs from programs.. ufff. its better to install ALLL that software instead relocatin every single. jpg.

Here are my two last posts which i was redirected from"


The original:
http://www.bleepingcomputer.com/forums/topic451156.html

The second:
http://www.bleepingcomputer.com/forums/topic451462.html

(please forgive my english)

Edited by hamluis, 30 May 2012 - 12:27 PM.
Moved from Win 7 to Am I infected - Hamluis.


BC AdBot (Login to Remove)

 


#2 Cataria

Cataria

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:11:11 AM

Posted 07 May 2012 - 09:55 PM

Hey there,

Here's my understanding from reading the past posts.

I would said the files are deleted, not hidden in any way. Think of delete as meaning "I don't want this anymore," not "remove this now." The file contents are actually still there, but the space the file takes up is physically available so that if that space is needed, the computer will overwrite the deleted data with the new data you actually want.

I've never used the Pandora recovery software (I've used different software), so I'm looking at this .PDF for reference. http://www.pandorarecovery.com/doc/PandoraRecovery_HelpSystem.pdf From what I can see, Pandora has some different recovery methods. Have you tried using the Browse method? It looks like it tries to index the files with their original file names and folder locations. If you use one of the other methods like Surface Scan, it will find a lot more files (such as ones not listed in the master file table anymore, if I understand correctly), but the ones that you need are probably in the master file table.

Also, while you are sorting through the pictures you recovered, I would highly recommend that you save all of them to another drive, if you haven't already. If you keep creating new files and installing new programs on the drive that has the deleted data you are trying to save, you could overwrite the pictures you are trying to keep.

Questions:

1. All the software that you found pictures for (icons, logos, etc) -- is the software still working? Do those logos etc. show up in the software? If that's the case, then you don't need to try to restore those pictures. If you used Surface Scan, I suspect it can find images that the software are using that are actually embedded in other files (probably .dlls) and thinks it was deleted, but that's a guess. If that is not the case and the software isn't working, let us know.

2. You said this all started when you were testing some screen capture software. What software was it?

Edited by Cataria, 07 May 2012 - 10:05 PM.


#3 FlyerX

FlyerX
  • Topic Starter

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Local time:11:11 AM

Posted 07 May 2012 - 11:32 PM

Hi!
thanks fortaking from your time to help me!

I would said the files are deleted, not hidden in any way. Think of delete as meaning "I don't want this anymore," not "remove this now." The file contents are actually still there, but the space the file takes up is physically available so that if that space is needed, the computer will overwrite the deleted data with the new data you actually want.

i got that.


I've never used the Pandora recovery software (I've used different software), so I'm looking at this .PDF for reference. http://www.pandorarecovery.com/doc/PandoraRecovery_HelpSystem.pdf From what I can see, Pandora has some different recovery methods. Have you tried using the Browse method? It looks like it tries to index the files with their original file names and folder locations. If you use one of the other methods like Surface Scan, it will find a lot more files (such as ones not listed in the master file table anymore, if I understand correctly), but the ones that you need are probably in the master file table.

mmm.. i have never use pandora, i didn't knew it, i'll give it a try in the browser method you mention.


Also, while you are sorting through the pictures you recovered, I would highly recommend that you save all of them to another drive, if you haven't already. If you keep creating new files and installing new programs on the drive that has the deleted data you are trying to save, you could overwrite the pictures you are trying to keep.


well, i was trying to recover it from linux (is in the same disk but in different partition), but i dnot know how to use the software (getdataback is what i have)) there,
i dont have an external enclosure to take the drive off an try in another computer.

what i am doing is, i restart in safe mode (the partition where the problem is) and i run getdataback, (i suppose that even restarting to windows creates files or something that may use the space of the "Deleted files") and y copy the recovered files to another partition, but its too much.

i really would like to know what caused this, i ran several scans, malware antispy antivirus rootkits as youc an see in the past posts, if i could only undone or fix what deleted all those files and they came back again to where they were....

Questions:

1. All the software that you found pictures for (icons, logos, etc) -- is the software still working? Do those logos etc. show up in the software? If that's the case, then you don't need to try to restore those pictures. If you used Surface Scan, I suspect it can find images that the software are using that are actually embedded in other files (probably .dlls) and thinks it was deleted, but that's a guess. If that is not the case and the software isn't working, let us know.

2. You said this all started when you were testing some screen capture software. What software was it?


answer to 1st
no, i just used couple of software and they were running erratically. i have a game (LFS) and when i run it it shows me a messages "missing images", so i guess the rest of the installed soft are in the same status.

answer to 2nd
i have had power failures the days before the problem occurred, i use hibernation instead power off because i work with many windows and notepads opened and to close and to open them in the same order (must be) its difficult, so i just hibernate, but if the power failure occurred at least, with a software that automatically take a photo of the screen every15minutes, i could know the order and part of what i ad on screen, sounds weird but something i work with so many files and folders opened that i cant remember with what letter and folder i was working and i MUST continue with that, so if i have a screen-capture i could remember the file opened and to find it to continue working.
i found some screen capturer software and i started installing some screen capture software to see witch one likes me most, but i had to turn off the AV because one of them was recognized as virus.

in a simpler way the screen capture tells me with what i was working with.

BUT you know that!?,
there is something i have not told here because i didn't notice until minutes ago. the only pictures not missing (ot deleted nor hidden) are the last pictures the screen capture soft takes.

it is like if the screen capture software would have deleted all the pictures to place its pictures

Edited by FlyerX, 07 May 2012 - 11:33 PM.


#4 Cataria

Cataria

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:11:11 AM

Posted 07 May 2012 - 11:47 PM

Oops, my brain decided you were using Pandora for some reason -- I think I was reading another topic about recovering files and my brain merged the two. But yes, try the Browse scan and let us know how it works out!

Do you have an external hard drive or a USB drive you can saved the recovered data onto? That's what I try to use.

I would agree that reinstalling the software that is having any issues would be much easier than trying to figure out where to put the recovered images and figuring out what the pictures are supposed to be named. However, I would wait until after you try out Pandora (or any recovery software you can find that will try to use the data from the master file table) to try to minimize the amount of data you are overwriting.

Do you know which screen capture software was identified as a virus? I'm wondering if that is what caused the mass JPG deletion in the first place. From the other topics it looks like whatever caused the whole thing is gone, but it would be good to know what caused it in the first place so it doesn't happen again.

#5 FlyerX

FlyerX
  • Topic Starter

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Local time:11:11 AM

Posted 08 May 2012 - 01:06 PM

Do you have an external hard drive or a USB drive you can saved the recovered data onto? That's what I try to use.


well i have one that i use for backup, but the backup its 4 months old, but i was able to get a 80gb in that drive, and the files i need to restore in the laptop would not reach the 15gb, the problem is that the recovery software i am using duplicates many files, they show the same size name and properties, but i know some of the are bad, and the files i need with its duplicates reach the 225gb, i would need to extract those 225gb and review every file manually to see wich one is good or not (with a view in the windows browser is enough if the file is good it will display a thumbnail.

other reason i would have to restore the whole 255gb of "recovery data" is, while i check the integrity of the files, i make sure nothing else is lost, because what it terrifies me the most is what i dont know that i have lost.

if i dont buy a new drive, the easier way would be to try another software that could show me the real file sin good conditions, what i will give it a try to the Pandora, i dont knwo if pandora run from usb or in another partition because since i only have one internal sata drive (the laptop's hdd)every time i restart the laptop files are written.


I would agree that reinstalling the software that is having any issues would be much easier than trying to figure out where to put the recovered images and figuring out what the pictures are supposed to be named. However, I would wait until after you try out Pandora (or any recovery software you can find that will try to use the data from the master file table) to try to minimize the amount of data you are overwriting.

i agree with that too, i would even choose to reinstall windows, but i need windows to access to the driver because i dont have another sata, laptop hdd, neither a reader for sata drives, i have other HDD but they are for desktops.

i think that i will have to buy at least a small sata drive for the laptop to install windows and a 2.5sata enclosure to continue working on the recovery, or if i could boot windows from a usb, or if Pandora works from linux, then the partition would remain untouched.

Do you know which screen capture software was identified as a virus? I'm wondering if that is what caused the mass JPG deletion in the first place. From the other topics it looks like whatever caused the whole thing is gone, but it would be good to know what caused it in the first place so it doesn't happen again.


that's the weird thing, i think (because i havent read the log file si posted in the past responses) but they were ccleared by the guys that help me there, so i assume none of the screen capture was infected.

#6 FlyerX

FlyerX
  • Topic Starter

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Local time:11:11 AM

Posted 30 May 2012 - 06:47 AM

Good morning guys!

Updates of my case (Continuation from here; http://www.bleepingcomputer.com/forums/topic451462.html/page__st__15)

I finally receive the accessory for transfer my data from the hdd with the deleted pictures to the new hdd, (yes i had to install everything again) (a sata usb adapter), as i said before, the pictures can be seen with any recovery software, they are just simply marked as deleted (the recovery software shows its status as "deleted" files. but i have to manually relocate EACH photo file because they are oput of order, duplicates and many with unknown names. the problem only affected jpg's files (what virus, trojan causes that? it looks to be the most powerful or mysterious one because all the scans (antimalware, antispyware, antivirus, combofix.. etc...) the computer was clean.

well.. it toke me the whole day (yesterday)to recover the whole disk (the disk that has windows with the problem of the deleted pictures), but while the recovery software was copying to an other external hdd (i didn't wanted those file in my new hdd with fresh windows yet) the antivirus shows me many alerts of viruses there yet.

WHAT viruses? if i did not connect the computer to internet since the fist day i noticed the pictures were missing (remember my fist post of the black wallpaper?...) and after all the scans and processes we did in all these posts:
http://www.bleepingcomputer.com/forums/topic451156.html
http://www.bleepingcomputer.com/forums/topic451462.html
http://www.bleepingcomputer.com/forums/topic452820.html

and i fear the new OS get infected while recovering the files from the old hdd. but i had no choice.

when i finished the recover, i ended with 15 viruses alerts and 3 suspect programs founds, for a total o 23 viruses and an antivirus (avira free antivirus) with errors:Posted Image

the viruses founds were: (copy from the reports:
[DETECTION] Contains recognition pattern of the DR/FakePic.Gen dropper
[DETECTION] Is the TR/Crypt.XPACK.Gen5 Trojan
[DETECTION] Contains suspicious code HEUR/Crypted.E
[DETECTION] Is the TR/Dropper.Gen8 Trojan
[DETECTION] Contains suspicious code HEUR/HTML.Malware
[DETECTION] Is the TR/Crypt.ULPM.Gen Trojan
DETECTION] Is the TR/Trash.Gen Trojan


why was not detected if the system has been untouched in order to avoid deleted files could be overwrite... where those viruses came from why was not detected when the other three forums?

Edited by FlyerX, 30 May 2012 - 06:48 AM.


#7 toofarnorth

toofarnorth

  • Members
  • 373 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:11 PM

Posted 31 May 2012 - 01:31 AM

if you are using getdataback you need to select the "i want to recover deleted files" at the bottom of the first selection list. this will scan for whatever is deleted and show those folders with a line across it. then you can select the folders and copy them to another harddrive.

hth!

TFN

#8 FlyerX

FlyerX
  • Topic Starter

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Local time:11:11 AM

Posted 31 May 2012 - 10:08 AM

if you are using getdataback you need to select the "i want to recover deleted files" at the bottom of the first selection list. this will scan for whatever is deleted and show those folders with a line across it. then you can select the folders and copy them to another harddrive.

hth!

TFN



uhhm...
the problem is not using getdataback

what i am saying is, pictures were deleted by something unknown, after extensive virus trojan searches recommended in this foum, no major viruses nor trojan were found, BUT the pictures were found by getdataback, but when i try to pass the pictures using the disk where they are as external disk, then ALL the viruses and trojans appear (i am saying that whe i was scanning from the disk it selft no virus or trojan was found, and when i scan it as a external disk, there is lot ov vviruses and trojans not seen before)

The other thing i am stating here is that new viruses and trojans were found when copying data from the disk with the problem to another external disk and i have fear one of those trojans that was not catched up with the procedures done before by suggestion in this forum, infect my system again

#9 FlyerX

FlyerX
  • Topic Starter

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Local time:11:11 AM

Posted 27 March 2016 - 12:36 PM

Hi guys!

 

 

just for information/curiosity

 

 

Maybe it’s maybe is not...

 

Yesterday, organizing files in my computer i found a zip file with the files i was working when that horrendous thing happened to me...

 

i was unable to figure it out what happened, nobody was able to find any infection o r trace of it....   just pictures vanished, all file ending in jpg were sucked....  

 

but when i found that zip file.. just chilling and in a free time...i decide to run some scans to see if now 4 years later more modern and "effective" tools could find something that by that time were not up to that time scanners...

i run mbm, avast and superantispy....  none but mbm fund Riskware.Extension.Mismatch

 

 

could that be what erased my pictures 4 years ago?






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users