Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Missing files after deleted registry entries and system restore. Please help!


  • Please log in to reply
14 replies to this topic

#1 deliciousmix

deliciousmix

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:09 AM

Posted 27 May 2013 - 11:25 PM

Hello, I have done one of the stupidest things in the world and have been trying all day to recover my files that went missing.  Here's what happened:

I deleted a bunch of registry entries because Spybot S&D always showed these five things as threat level 5 and can't clean them.  I decided to search the registry for the string of numbers and letters that S&D referred to and deleted all of the ones it would let me delete.

I also deleted all of the files and folders in the location Users/HomeAppData/Local/Temp except the one file it wouldn't let me.

When I came back to Windows nothing was working so I rebooted.  When I rebooted all of my programs, files, everything was gone.  I did a system restore to the most recent point which was from a week ago which turned everything back to normal except some very important files are missing from a folder on my desktop.

I am a musician and have been working on a recording which I save as I go as multiple versions ex. song 1.1, song 1.2, etc.  All of the versions that were created after the available system restore date are gone.  But it's weird because the bounces that I did (wav files not pro tools files) from the later versions are there, just not their pro tools session file counter parts.

I've restored all of the files/folders to Users/HomeAppData/Local/Temp however that didn't change anything.

The pro tools files that went missing are not hidden, I can't see them when I show hidden files.  I've tried doing a system restore undo but I get an error message saying it can't do it.

Please help, I've been working on this song for a very long time and don't want to loose all of the hard work I've done.

Thanks,
Jeremy

 



BC AdBot (Login to Remove)

 


#2 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,230 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:07:09 PM

Posted 28 May 2013 - 12:01 AM

that's a bit hard, it's not like you can go about restoring them as they are most likely not lost but hidden... yaru might be able to help you. Didn't happen to run a reg backup before you started deleting keys?



#3 deliciousmix

deliciousmix
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:09 AM

Posted 28 May 2013 - 12:13 AM

no, would this work?  http://www.howtogeek.com/howto/31136/how-to-restore-previous-versions-of-the-registry-in-windows-7/

 


Edited by hamluis, 28 May 2013 - 11:17 AM.


#4 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,230 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:07:09 PM

Posted 28 May 2013 - 02:22 AM

quite possibly, as you know what you deleted you may be able to restore it like this... back up your files first though.

 

edit: and your registry too, you might make your machine unbootable.


Edited by TsVk!, 28 May 2013 - 02:24 AM.


#5 deliciousmix

deliciousmix
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:09 AM

Posted 28 May 2013 - 03:31 AM

Thank you TsVk! for taking the time to respond.  Any other suggestions before I try that, maybe from yaru?

 

Thanks again,

Jeremy



#6 deliciousmix

deliciousmix
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:09 AM

Posted 28 May 2013 - 03:33 AM

and I've backed everything up :/  Going to be doing that more often from now on...



#7 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,230 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:07:09 PM

Posted 28 May 2013 - 04:01 AM

yaru is a program, click the name to go to the page. Give it a go, it's got a function: 'Traverse the hive slack space and enumerate deleted keys'... That means, in very simple terms, it will look over the empty spots in the registry and guess the value of what's missing, cool feature. Might just save you.

 

 

Also, I have a dedicated machine just for making tunes on, which cannot connect to the internet, and has a dedicated external backup drive, in addition to all my project files being on a separate internal drive from the OS... I also learned the hard way.



#8 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,230 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:07:09 PM

Posted 28 May 2013 - 04:05 AM

Will ask my Linux super geek friend tomorrow for you, there might be a way to boot off a Linux disk and retrieve your info...



#9 deliciousmix

deliciousmix
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:09 AM

Posted 28 May 2013 - 04:56 AM

Ok thanks so much, I will try yaru.  I tried a Recuva deep scan but it didn't come up with anything.



#10 deliciousmix

deliciousmix
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:09 AM

Posted 28 May 2013 - 05:20 AM

I'm having a hard time finding out how to 'Traverse the hive slack space and enumerate deleted keys', It's not in any of the drop down menus.

 

I've opened the ntuser.dat file in yaru, but don't really know what to do...

 

Thanks again,

Jeremy



#11 deliciousmix

deliciousmix
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:09 AM

Posted 28 May 2013 - 05:26 AM

It's actually a different user hive that I opened, when I try to open the hive for my main account it sais "Problem opening hive".

 

There is a new user account folder called home.home-PC and my normal one is called home.  It's the home.home-PC hive that I can open.

 

I checked in the home.home-PC folder and there is no "desktop" folder.  The missing files were in a folder on the desktop.

 

Thanks.



#12 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,230 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:07:09 PM

Posted 28 May 2013 - 07:09 AM

did you not try to restore your data from the %/windows/system32/config panel?



#13 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,230 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:07:09 PM

Posted 28 May 2013 - 04:53 PM

I just spoke to my Linux friend, and he confirmed my suspicion... If you boot from a Linux CD you will be able to explore your current file system independent of the Windows OS. So, what this means is if it is still there you will be able to see it, and copy it. Even if your machine is unbootable (assuming your file system is not corrupt) you should just be able to mount a CD and go from there. If your file system is bad run sfc from the commond prompt at startup repair, can often help.

 

I can't see any reason for your files to be gone, unless another running process decided they were due for deletion when you changed the registry. In that case it is unlikely you will ever see them again... but this is unlikely.

 

Ubuntu Live CD is an easy choice... can probably watch a youtube vid or read a tute somewhere to show you how.

 

Good Luck!



#14 deliciousmix

deliciousmix
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:09 AM

Posted 28 May 2013 - 05:35 PM

Thanks TsVk! I will try all of that and let you know if it worked.  Still hoping I can figure this out.



#15 hamluis

hamluis

    Moderator


  • Moderator
  • 55,411 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:09 AM

Posted 28 May 2013 - 06:05 PM

FWIW:

 

Data Recovery , GParted, AA - http://www.bleepingcomputer.com/forums/topic474881.html

 

Data Recovery Using Puppy Linux, Brooks - http://www.bleepingcomputer.com/forums/t/489067/dual-boot-system-bluescreens-1-of-my-startup-choices/

 

Louis


Edited by hamluis, 28 May 2013 - 06:05 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users