Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Need help recovering history from hardrive!


  • Please log in to reply
14 replies to this topic

#1 bob1212

bob1212

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:11 PM

Posted 17 December 2015 - 02:21 PM

Hey guys, sorry if this is the wrong place for this...

 

 

A few years ago I was infected with a Trojan from somebody that I knew. To make a long story short, rumors flew and it ultimately became a severe source of depression, even after all this time.

 

The computer that was hacked was out of my possession for quite some time, and just a couple weeks ago I was able to get hold if again. I was very excited, hoping to be able to see all my past internet history/searches etc so I could finally put this behind me. My old user account (wasn't the administrative) was deleted, unfortunately. Also, it was on Windows XP.

 

 

I tried index.dat readers (It was an older IE/firefox used) which found searches I remember making on the administrative account, but nothing that was on the deleted account.

 

System restore wouldn't go back far enough.

Recuva didn't work unless I'm not utilizing it correctly.

desktop search programs resulted in nothing  

 

Is there anything I can do? Somebody I can send it to?? I am desperate!


Edited by hamluis, 17 December 2015 - 02:58 PM.
Moved from Internal Hardware to Bacup/Imaging/Disk Management - Hamluis.


BC AdBot (Login to Remove)

 


#2 RolandJS

RolandJS

  • Members
  • 4,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:11:11 AM

Posted 17 December 2015 - 02:34 PM

FF keeps it data in two places:

AppData Local Mozilla Firefox

AppData Roaming Mozilla Firefox

if anything you want has been overwritten in either one or both directories, it's gone.


"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#3 hamluis

hamluis

    Moderator


  • Moderator
  • 55,880 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:11:11 AM

Posted 17 December 2015 - 02:35 PM

I don't see where you state...that the infection was ever taken care of.

 

That being the case...what is it that you expect to be able to "recover" ?

 

Louis



#4 bob1212

bob1212
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:11 PM

Posted 17 December 2015 - 02:43 PM

I don't see where you state...that the infection was ever taken care of.

 

That being the case...what is it that you expect to be able to "recover" ?

 

Louis

I don't know if it ever was..

 

I just want to see the old internet history/searches, that's it



#5 bob1212

bob1212
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:11 PM

Posted 17 December 2015 - 02:45 PM

FF keeps it data in two places:

AppData Local Mozilla Firefox

AppData Roaming Mozilla Firefox

if anything you want has been overwritten in either one or both directories, it's gone.

 

How do I know if it was overwritten though? I can't see anything from the deleted account. Is there a way to recover the deleted account? Sorry, I'm not very computer savvy.



#6 RolandJS

RolandJS

  • Members
  • 4,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:11:11 AM

Posted 17 December 2015 - 02:47 PM

You just recently mentioned internet history...

Earlier, you mentioned FF, which I thought you meant Firefox; Internet history will be forthcoming from within your browser operations; if the traces are still there.  If you mean BOTH internet surfing and past emails, that changes what I thought you initially meant.


Edited by RolandJS, 17 December 2015 - 02:51 PM.

"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#7 RolandJS

RolandJS

  • Members
  • 4,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:11:11 AM

Posted 17 December 2015 - 02:52 PM

To recover deleted files but not yet overwritten foldervers and files will take much geek work!

Overwritten files will not be recoverable by any software means.


"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#8 bob1212

bob1212
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:11 PM

Posted 17 December 2015 - 02:56 PM

To recover deleted files but not yet overwritten foldervers and files will take much geek work!

Overwritten files will not be recoverable by any software means.

What kind of geek work?? Do you know any recovery businesses or something I could send it to? As I said before, I'll do whatever it takes! I asked local computer stores but they didn't know



#9 bob1212

bob1212
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:11 PM

Posted 17 December 2015 - 03:01 PM

I also know that this computer was regularly backed up. Now I don't know what kind of backup or anything( Yeah im stupid) is there potential to find it if I can contact the guy who backed it up? What the internet history files be backed up with it?



#10 RolandJS

RolandJS

  • Members
  • 4,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:11:11 AM

Posted 17 December 2015 - 03:13 PM

Asking the person who did regular backups just might be the answer!  As far as data recovery, prices can begin with $500 estimate and go as high as $1000+ with no guarantee of recovery.  Might recover much, might recover little.  Unknown 'til process completes.


"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#11 bob1212

bob1212
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:11 PM

Posted 20 December 2015 - 01:49 PM

Asking the person who did regular backups just might be the answer!  As far as data recovery, prices can begin with $500 estimate and go as high as $1000+ with no guarantee of recovery.  Might recover much, might recover little.  Unknown 'til process completes.

Thanks for the replies Roland! I was reading this article https://www.bullguard.com/blog/2014/08/5-ways-to-recover-deleted-internet-history-data-easily.html

 

it says there are people I can send the harddrive to, without getting specific. Any ideas on who or what businesses deal with this. Tried some google searches but nothing I could find.



#12 RolandJS

RolandJS

  • Members
  • 4,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:11:11 AM

Posted 21 December 2015 - 08:47 AM

At this point, I have no idea of where to send a hard-drive to.  I'm certain other BC regulars can provide a roadsign or two.


"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#13 dannyboy950

dannyboy950

  • Members
  • 1,338 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:port arthur tx
  • Local time:10:11 AM

Posted 21 December 2015 - 11:18 AM

If the backups were kept on the computer then look for back up folders in c-drive. If they were kept offsite like on a cd or memory stick or external hard drive then you would need access to those backups. Would you not?

HP 15-f009wm notebook AMD-E1-2100 APV 1Ghz Processor 8 GB memory 500 GB Hdd

Linux Mint 17.3 Rosa Cinamon


#14 cmptrgy

cmptrgy

  • Members
  • 1,656 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Massachusetts
  • Local time:12:11 PM

Posted 21 December 2015 - 12:37 PM

At some time the computer was infected with a Trojan.

--- You do not know whether or not the infection was ever taken care of.

--- Is the computer clean now?

 

You use Mozilla Firefox.

 

Now that you have the computer back you seriously want to see “the old internet history/searches, that's it”

You found searches that you had made on the administrative account, but nothing that was on your old user account that was deleted.

 

Your old user account (wasn't the administrative) was deleted and at that time it was on Windows XP.

--- What OS is on the computer now?

 

“I also know that this computer was regularly backed up.”

--- How was it backed up?

--- Was it done by a third party program and is their link still in your computer?

--- Is it possible there is a backup available from back then?

--- To me that is the only way to have a reasonable chance to get your deleted user account back.

--- Can you answer dannyboy’s backup questions in post #13?

 

One more idea

It appears to me that the computers OS was XP, but now it isn’t so maybe it’s been upgraded to Windows 7?

I don’t recall whether or not XP was upgradeable to Vista but if it is, the same principle applies.

--- See if Windows.Old exists on your computer

--- Check out How to restore your files from the windows.old folder after upgrading

http://www.howtogeek.com/130558/how-to-restore-your-files-from-the-windows.old-folder-after-upgrading/

It might not apply for the information you are looking for as it deals with files but I’d rather submit that possibility instead of ignoring it



#15 bob1212

bob1212
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:11 PM

Posted 22 December 2015 - 08:31 AM

At some time the computer was infected with a Trojan.

--- You do not know whether or not the infection was ever taken care of.

--- Is the computer clean now?

 

You use Mozilla Firefox.

 

Now that you have the computer back you seriously want to see “the old internet history/searches, that's it”

You found searches that you had made on the administrative account, but nothing that was on your old user account that was deleted.

 

Your old user account (wasn't the administrative) was deleted and at that time it was on Windows XP.

--- What OS is on the computer now?

 

“I also know that this computer was regularly backed up.”

--- How was it backed up?

--- Was it done by a third party program and is their link still in your computer?

--- Is it possible there is a backup available from back then?

--- To me that is the only way to have a reasonable chance to get your deleted user account back.

--- Can you answer dannyboy’s backup questions in post #13?

 

One more idea

It appears to me that the computers OS was XP, but now it isn’t so maybe it’s been upgraded to Windows 7?

I don’t recall whether or not XP was upgradeable to Vista but if it is, the same principle applies.

--- See if Windows.Old exists on your computer

--- Check out How to restore your files from the windows.old folder after upgrading

http://www.howtogeek.com/130558/how-to-restore-your-files-from-the-windows.old-folder-after-upgrading/

It might not apply for the information you are looking for as it deals with files but I’d rather submit that possibility instead of ignoring it

 

The computer wasn't being used for years, so it's still XP.

 

There is a backup program on the computer called Backup Now! 4 I believe. It was a CD backup program when I clicked it, can a whole system image backup be done on a CD? (I'm assuming that's the kind of backup I'd need, correct?)

 

On My Computer it shows the computer was connected to a "server f", would that potentially be an external backup or no? (When I click it, it says It can't connect, although I havn't tried it with the internet connected) Would I be able to see somewhere what kind of backup it was? Sorry If I don't make sense I'm not much of a computer guy.

 

I'm going to try and contact the original owner soon and ask him.

 

Another thing I heard is that ISPs may hold on to it? Is there potential to find it from them?

 

Thanks so much for the replies everyone I really appreiciate it!






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users