Need Advise/ The next step

[kpm850]

I have an HP notebook with a 75 gig HD. I have always used XP PRO as the O/S. I was having problems and mistakenly deleted 5 registry files attempting
an MS boot up Advanced Recovery method.

When I booted with the XP CD, it gave an Advanced Recovery option
and a New Install option. After trying the Advanced Recovery directions from Microsoft and failing several times, I gave up.

Not knowing what damage it would do, I reloaded the XP Pro by booting with the XP Pro CD and proceeded with the install on TOP of the existing installation (maybe a bad idea). I also loaded the same business software that was on it before. Nothing more. Also, I did not set a new partition.

And began using the Notebook for about 1.5 days. I did not use it hardly at all and I have stopped using it altogether until after this recovery is done.

With the files missing I found RMF on the web and bought it. I downloaded it to the new XP install in the damaged O/S Notebook not knowing this is also not a good thing.( better to use a Writable CD with RMF loaded on it).

The only file types I need are the PDF and the Word files.

There were no pictures,audio, games, power point, etc files that I loaded.
The PDFs' and the Word files are the only important files I needed.

I was hoping I could get my emails. Only the ones in the Outlook 2000
inbox and some in Outlook Express.

I tried running RMF (Complete Format Recovery choosing manual input) looking for just the PDF files. 1071 recovered files with no file names. Most files were damaged or corrupt. All had the "Recovered File" extension. A small percentage were recovered that were OK.

( I am going to pause )
For any reader, RMF DID recover files for me! It does work. Just wanted that fact pointed out. A miracle in my book !

I read several posts and followed a post where a senior member directed
to do a "Complete Format Recovery" using only the default settings.

Chose C:\ as the search and it showed 75 GIG. After 15 hours it found the MFT table, recognized the NTSF partition ( the notebook always had just 1 partition) and found the default requested file types. There was a 0 drive with
75 GIG available to search but the post indicated to try C:\ first since
there is only 1 hard drive.

As I type this, ALL the 229,846 files RMF recovered (the indicator reads 52 GIG total) are being saved to a new WD external 160 GIG HD. My original install was, with all files, 14 GIG. Not sure about how it turned into 52 GIG unless the .Zip files are unzipped.

My question is, except my error for loading XP Pro over the existing XP Pro
installation and re-installing the software and loading RMF on the old
installation of XP Pro, have I missed a step at this point ?

In the event log it shows it is recovering the XP Pro O/S files and thier
names, but not the PDF and Word file names. The PDF and Word files
are the most important for my business.

Anyway, I thought the RMF program would rebuild after the Complete Format
Recovery using the default settings search and maybe it already has
but the PDF and word file names are not there.( I am reporting this from
what I see in the event log as the "save" process is saving the files )

If possible, please advise if I need to take further steps to recover
PDF and Word document quality and file names.


Thanks in advance.

P.S. I would like to recover the emails if possible after this "default" search and save.

[GDH]

You need to try the following 2 different types of search:

1. Complete Format Recover:

* Run a Complete Format Recover.
* In your case I would search the "physical drive".
* Search only for the default selected file types, (.doc, .xls, .pdf, .avi, .jpeg, .bmp, but also add .pst and .dbx for your email.).
* At then end of the search look in both "File View" and "Folder View" for your files. Folder View is where you will see your full file names if they are recoverable.
* Click on the files to preview their content and then save those that you can preview.

This search uses the Operating System records (MFT records) to find the files. The reason that you are now saving the volume of data that you are is that these records are now corrupt and do not accurately point to the corrrect ending location of each file making the files actually bigger than they really are.


2. Complete File Search

* Run a Complete File Search for .doc, .pdf , .pst, and .dbx.
* This search uses a slightly different technique (it is searching for the header and the footer of each file) and may give you different results from the above seach.
* It will recover files but they will not have their original file name.
* Click on the files found in the results window to preview their content and save those of value.

[kpm850]

Thanks for the quich response.

I began the search using c:\. The physical drive is labeled "0".

Will the search for the physical drive and then saving those files interfere with
the files saved in the current search of c:\ ?

In other words if I go ahead and finish with the saving process of files recovered in c:\
and then do the search on the physical drive and save those files as well,
will the files I saved in c:\ need to be deleted first before I save the recovered
files in the physical drive ?

Again, thanks in advance.

[GDH]

You must save the files you find to another drive. You can run the search as many times as you want and save each search result in a separate folder on your other drive.

Inside your PC you have a hard disk. This is called "physical drive 0". If you have two hard disks you will have "physical drive 0" and "physical drive 1".

On a physical drive you have partitions. For example your hard drive could have "logical" drive C: D: E: and F: all on physical drive 0.

If you only have one drive and it contains a C: drive, then searching the C: drive is almost the same as searching physical drive 0 so you can expect the search results to be very similar.

[kpm850]

Did a Complete Format Recovery of the physical drive. Defaults settings
with 2 email recovery options. I saved all recoverd files to a 160 gig HD.

The search for the physical drive output did not give file names and 80%
of the PDF files were corrupt.

Documents that were scanned and set in PDF format were the ones
corrupt.

I have ran several different types of search, the results are the same.

If there is any other action I can take, I would appriciate the advise.

Thanks



Is there a search with different settings I might be able to do to get better
results

[GDH]

Please send me samples of the corrupt PDFs and also a sample of a real valid one.

It may be that the scanning process is adding data to the file and changing the file structure.