Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Removed a domain, boss' documents disappeared, help!


  • Please log in to reply
9 replies to this topic

#1 migelito

migelito

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:44 PM

Posted 22 September 2016 - 07:21 PM

This is a weird one.  A boss asked me to take a laptop that used to be a work laptop and was now being used by a daughter for school and "make it safe."  In other words, remove the VPN, our software and anything else that would be bad if it fell into the wrong hands.  I say no problem, and get to work uninstalling stuff.  I look at the user folder and see a familiar name and that gets me curious, so i am checking the identity of the laptop and i see that it is still technically on our Domain, even though it is not actively connected to the network.  so i figure, I'll remove it just to be safe.  I put it on a generic workgroup and made sure to blank the local user account password to make it easy.  Little did i know, the child was using a renamed domain account.  when i disconnected it, the user folder remained, but all of the documents (term papers, homework assignments, all of it) just disappeared.  Now i have gone from the guy who did the boss a solid to the a--hole who may have deleted the only copy of this child's academic history.  i tried restoring deleted files.  they weren't among the restorable files, it was just the usual internet temp files.  So i figure, they are still on the computer, windows just will not let me see the locations.  i've tried manually typing in the folder location, windows says it doesn't exist. I tried "restore previous versions" of the user folder, it said there were none.  i even connected to the company wifi and rejoined the domain.  then i found a very old version of one of the folders in question, but it was left on the file server from the last time the laptop had been connected to the domain.  it was not the local version still nothing current.  does anyone have any suggestions or should i just reconcile myself to never getting another promotion ever again?



BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,113 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:44 AM

Posted 22 September 2016 - 07:37 PM

I have no suggestions...but your situation is a good reason to always make a backup of the existing system structure...before modifying it, cleaning it, etc.  A CYA drill that comes in handy often, IMO.

 

Louis



#3 JohnC_21

JohnC_21

  • Members
  • 24,297 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:44 AM

Posted 22 September 2016 - 07:51 PM

If there is no profile of username,domain  on the computer I think your out of luck but I may be wrong.



#4 Trikein

Trikein

  • Members
  • 1,321 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Rhode Island, US
  • Local time:12:44 AM

Posted 22 September 2016 - 08:18 PM

IMO your boss shouldn't have let his daughter use a work laptop without someone doing what you did first. If you had, the issue wouldn't have occurred.  Also, I don't see you mentioning that he requested backup of the files on the laptop, he just asked you to "make it safe". To get the files back you would need data recovery software. I hear some good things about Recuva, but have never used it.



#5 JohnC_21

JohnC_21

  • Members
  • 24,297 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:44 AM

Posted 22 September 2016 - 08:35 PM

If scanning the drive with recuva I would immediately stop using the computer. Pull the drive and connect it to another computer to scan the disk. The more the disk is written to the less chance for recovery.


Edited by JohnC_21, 22 September 2016 - 08:36 PM.


#6 migelito

migelito
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:44 PM

Posted 22 September 2016 - 11:21 PM

IMO your boss shouldn't have let his daughter use a work laptop without someone doing what you did first. If you had, the issue wouldn't have occurred.  Also, I don't see you mentioning that he requested backup of the files on the laptop, he just asked you to "make it safe". To get the files back you would need data recovery software. I hear some good things about Recuva, but have never used it.

 

I actually used Recuva (and you're right, I like it too), but there were no document files in the recovered data.  This is part of what makes me think removing a domain didn't actually delete the files, just secured them where it wouldn't let me get to them.  The folders didn't seem to get smaller in size.  



#7 hamluis

hamluis

    Moderator


  • Moderator
  • 56,113 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:44 AM

Posted 23 September 2016 - 08:02 AM

You can use a tool like Everything to search for files by name/location, etc. if you have any clues to what the content is.

 

Everything Search Engine - http://www.voidtools.com/

 

Louis



#8 migelito

migelito
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:44 PM

Posted 23 September 2016 - 11:40 AM

You can use a tool like Everything to search for files by name/location, etc. if you have any clues to what the content is.

 

Everything Search Engine - http://www.voidtools.com/

 

Louis

 

Thank you! Well, one good thing; Everything shows that the files are there.  i just can't seem to get to the files or copy or move them.  Linked is a snip to show example (i couldn't get it to post as an image).  any ideas?

  https://drive.google.com/open?id=0B7h7oZgtlHpBdmZJUWpTakpJa3c



#9 JohnC_21

JohnC_21

  • Members
  • 24,297 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:44 AM

Posted 23 September 2016 - 11:48 AM

Enable the Hidden Administrator account (SuperUser). At an elevated command prompt type

net user administrator /active:yes

Login to the Administrator account and see if you can move and copy your files.



#10 migelito

migelito
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:44 PM

Posted 23 September 2016 - 02:28 PM

the command worked so i am now the local admin, but it was acting like the paths do not exist.  Because i am the admin with full rights though, i was finally able to go to security and take ownership of the path in question.  i gave myself full control and it finally, finally let me in!!  Thank you, Louis and JohnC! The two suggestions got me to where i needed to be and saved my proverbial bacon.  i will be more careful in the future.

 

Thanks guys!






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users