Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Files mysteriously deleted - virus???


  • Please log in to reply
8 replies to this topic

#1 krs000a

krs000a

  • Members
  • 65 posts
  • OFFLINE
  •  
  • Local time:10:05 PM

Posted 27 March 2017 - 03:17 AM

Hello,

 

I normally have a very small txt-file in my C: root directory.

Today when I turned my computer on, that file is mysteriously missing. I search for it in the harddrive, and all I find is a shortcut for it (???) which points to a deleted file. Well, I never deleted it! I mean, I am 110% sure I have NOT deleted that file. It's been there for years, and I use it daily. I most recently used it yesterday!

But I ran Recuva, and it indeed shows the txt-file as deleted. It also finds hundreds thousands of other txt-files, which I in fact HAVE deleted months ago, and these are fully recoverable as no overwritten sectors are detected, but NATURALLY the condition of that one particular file which I need - which according to Recuva apparently was deleted yesterday March 26 without my consent - is listed as "Very Poor" and parts of it has been overwritten by a file in the c:\Windows\Prefetch folder. Well, that is just great. I MUST have this file back.

Why on earth was it deleted anyway? Is there a known virus that randomly deletes files off the harddrive or what? Does it sounds as if I have been infected? I have scanned for viruses and malware and nothing at all has been found.


Edited by krs000a, 27 March 2017 - 03:19 AM.


BC AdBot (Login to Remove)

 


#2 RolandJS

RolandJS

  • Members
  • 4,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:03:05 PM

Posted 27 March 2017 - 05:40 AM

"...I MUST have this file back..." -- thread starter

Any file partially over-written is going to be almost impossible to bring back, to recover, to its previous pristine state.  If your recent current backups are not recent or current, going forward, please make sure you have recent current backups of your data on external media.  Like you, in the past, before I really got with making recent current backups onto external media, I too had lost a few very valuable data files, I understand.

Remotely possible, an "immediate" usb or dvd boot of anything similar in power and depth to Minitool Power Data Recovery or R-Studio -- might, possibly, find enough sector bits and pieces, via a "text string search" to locate and copy to available external media said sector pieces; this process and the reconstruction will be similar to going into a automotive junkyard, finding all the pieces of XYZ automobile from all over the yard, and putting it together on a tarp.


Edited by RolandJS, 27 March 2017 - 09:20 AM.

"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#3 krs000a

krs000a
  • Topic Starter

  • Members
  • 65 posts
  • OFFLINE
  •  
  • Local time:10:05 PM

Posted 27 March 2017 - 06:53 AM

Thank you for replying. I know, I should have backed this up, especially since it was such a ridiculously small file.

Unfortunately I didn't and the file is beyond salvation now - I attempted to restore it anyway and it contained only rubbish after being partially overwritten.

 

What gets me is how did it get deleted in the first place? I don't consider myself a computer expert, but I do know that I did not - intentionally or accidentally - delete this file. And there is nobody else that have access to my computer, unless someone hacked through my firewall and accessed the file that way, but that is just so far fetched.

Is it possible that this could have been the work of a virus? I really want to make sure it doesn't happen again, to other files. As a matter of fact, it might already have, I just happened to notice this one deleted since I use (well, used) it on a daily basis. That said, so far this is the only thing I've actually noticed missing. Very weird.

 

The fact that this was deleted as recent as less than 24 hours ago, and the computer has remained turned off for most of the time since, but the file somehow STILL managed to become partially overwritten almost immediately annoys me even more, especially since there are countless other txt-files, many of them deleted as far back as 2014, that Recuva found and could restore to completion since no data had been written on top of those. I mean, come on.



#4 RolandJS

RolandJS

  • Members
  • 4,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:03:05 PM

Posted 27 March 2017 - 09:23 AM

Most of the time, whenever any data is modified, written to, shrunk, expanded, altered, etc., Windows will place the newest version of said file onto the hard-drive and the previous version is deleted.  Hence, one often finds several or more copies of the same file, however, with various dates and times.  I was hoping the write/delete-write/delete process would leave bits and pieces of that file on the hard-drive. 


"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#5 krs000a

krs000a
  • Topic Starter

  • Members
  • 65 posts
  • OFFLINE
  •  
  • Local time:10:05 PM

Posted 27 March 2017 - 10:33 AM

Sorry to bother you again... But I installed Minitool Power Data Recovery but I can't quite figure it out. How would I go about to find these multiple copies of that file? Even if I can't get the complete file back, anything would help. I tried the various scan features on the main menu but it can't seem to find any trace at all of that file. Maybe I'm not doing it correctly.



#6 RolandJS

RolandJS

  • Members
  • 4,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:03:05 PM

Posted 27 March 2017 - 11:21 AM

I'm a sub-teacher at a high-school, I'm constantly in and out of here; I don't remember the keystrokes for "text string / sector" search; I will set up six test files on my itty bitty 1GB partition and see if I can post the keystrokes from my copy of MTPDR.  Hopefully, others will also weigh in.


"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#7 krs000a

krs000a
  • Topic Starter

  • Members
  • 65 posts
  • OFFLINE
  •  
  • Local time:10:05 PM

Posted 27 March 2017 - 12:07 PM

Thank you. I really appreciate your help!



#8 RolandJS

RolandJS

  • Members
  • 4,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:03:05 PM

Posted 27 March 2017 - 02:20 PM

II'm not much good today, can't find the "text string search" function...hopefully, others will enter in and help out.


"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#9 krs000a

krs000a
  • Topic Starter

  • Members
  • 65 posts
  • OFFLINE
  •  
  • Local time:10:05 PM

Posted 29 March 2017 - 12:28 AM

Hey, I did some further research in this previous versions of files and found out that Windows Vista Ultimate, which happens to be the OS on this computer, has this built in Shadowcopy feature which you can access by Properties > Previous versions, and lo and behold there was the file, just in the condition before it was mysteriously deleted! Wow, I'm so thankful for this. Had you not mentioned the previous versions I would not have known about it - so thanks a million. :-)






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users