File Recovery

[Chooly]

What program would you guys recommend to recover deleted files, pictures etc.
I mean like after a total system restore after a crash.
A family member went messing around in their registry and deleted important stuff. And for some reason after the computer wouldn't boot, didn't come to me, instead opted to reinstall windows. Will they be able to recover the things that they had before the crash / reinstall?

[IdiotWithGuns]

[15:09] copulatimgduck|afk: dude
[15:09] copulatimgduck|afk: your done
[15:09] copulatimgduck|afk: after reinstall
[15:09] copulatimgduck|afk: your fucked

[zaneyard]

[15:09] copulatimgduck|afk: dude
[15:09] copulatimgduck|afk: your done
[15:09] copulatimgduck|afk: after reinstall
[15:09] copulatimgduck|afk: your fucked

[Chooly]

A recovery, actually...
So all of the programs didn't get deleted, all the documents pictures etc otoh...
The HP box has a partition made for backups, a locked partition I can't access, even as admin. Tried from the cmd prompt, access denied as well.
I would really like to peek around inside that partition to find out if the documents are stored inside it.
My next question,
after a recovery, docs and etc are left in place? or moved to a recovery foler? or inside a compressed recovery file?

[HeK]

Convar has some nice tools to try out: http://www.convar.com/Default.htm?language=1

Also, don't write anything to the drive.


There are other tools that are likely better, but I have never used them.

[zaneyard]

A recovery, actually...
So all of the programs didn't get deleted, all the documents pictures etc otoh...
The HP box has a partition made for backups, a locked partition I can't access, even as admin. Tried from the cmd prompt, access denied as well.
I would really like to peek around inside that partition to find out if the documents are stored inside it.
My next question,
after a recovery, docs and etc are left in place? or moved to a recovery foler? or inside a compressed recovery file?

no clue, i dont know what you mean by recovery
if it involved a format and re-install, your screwed.

[rumsfald]

I think most of the locked partitions on OEM boxen are where the winders install/recovery files are located (as opposed to the crippled CDs). So I don't think the documents would be in there.

Unless the user was sophisticated enough to set up a separate partition, but since they messed with registry files randomly I rule out this option.

Most of the documents were probably in the user's old "My Documents" folder under their username, which can often only be seen by that user or the admin. It could be that the winders recovery re-built a new "My Documents" folder, thus further obscuring the old one from your vision. Like HeKyle the HeMan said, don't write anything to the drive, as the missing documents could be sitting their waiting to be overwritten, but might still be recoverable. There's a bunch of tools out there, but I haven't used most.

Have you tried hooking the drive up to a different computer and inspecting from a different winders install?

[HeK]

I remembered another tool, R-Studio: http://www.r-studio.com
It worked really well for me, recovering files from a formatted HDD. Mind you, it was FAT32.


If your friend formatted with a reinstall, your files have likely been (at least partially) overwritten by the new OS. Otherwise, as Rummy said, the account profiles (along with all the 'MyDocuments') have been renamed. Look inside 'C:\Documents and Settings\' for folders named 'someguy.somecomputer'. You should do this under an Administrator account with 'hide system files' off.

[Mission Difficult]

The locked HP recovery partition will only have you're files if you created a recovery image of them. In that case you would have to use the HP recovery tool to perform a recovery.

[IdiotWithGuns]

The locked HP recovery partition will only have you're files if you created a recovery image of them. In that case you would have to use the HP recovery tool to perform a recovery.

So basically... your screwed man