I don't think the program found my files...

[shawna]

Sorry, long post...
Recently I tried to install Norton Antivirus on Windows XP. I cancelled it partway through because of incompatible files warning, yet it showed up in Add/Remove Programs. I tried to remove it, computer froze, and in the end restarted. The desktop came back with default icons. We thought some dlls or similar files were gone, so we attempted to reinstall one or two programs, some would, others said they were already installed. These weren't big programs.
Problem is we then noticed that directories of installed programs under Program Files were blank and even whole directories were missing, such as my Canon directory with my digital pictures in it (all jpegs). We did a System Restore and that brought the directory structure and installed programs back, but not the associated data files such as pictures.
So I tried the recover my files program, and it found some of my pictures, but I think it is just ones that I had previously editted, viewed and/or deleted (most of these had recovery - unknown). For instance the latest pictures which I downloaded 3 weeks ago, but never looked at, it didn't find one of them. However, it found a lot of corrupted files. I have yet to pay for the key, and I have no problem paying if it solves my problem, but from the looks of things my pictures are unrecoverable (recovery unknown, corrupted, or just "not lost"). From the sounds of things does it look like my files are recoverable?

[rbruers]

You might want to try a Format recovery, and see if it finds more files. This might take some time.

[shawna]

Anything with the word format in it scares me a bit :-) I read the d********** of format recovery but don't quite understand what it does. It said it will rebuild the partition...is it going to re-format the drive?

[GDH]

I guess that you ran a "Complete Search" using Recover My Files to search for your deleted pictures. This is a very comprehensive search and if you could not preview the ones that you were looking for then they are probably gone. The problem with data recovery is that if you have since written to the disk then you can easily overwrite and destroy deleted data. Guess what a System Restore does - writes data all over the disk .

You can try a few things:

1). Make sure that the files are actually deleted, it sounds like the virus program did some wierd things to your system and it may have hidden the folders some how. Run a Complete search and in the drive selection windows "Add a folder to your search". I would add the C:\ drive as a folder, it will run throught all the files on your system and you will be able to preview the picutes. Recover My Files works by recognising the file type by the header, footer etc. so if the files have changed extension or something like that you will still find them.

2). In a separate search, click on the "Manually Set Options" button and go to "Advanced" you can change the search level to "sector" - its a lot slower (run it overnight) but that is the lowest level search possible. I doubt that it will find anything more, but if you have the time then it cant hurt to give it a try.

3). Because you are dealing with missing folders, you can try running a Format Recover. Search the logical drive (that is, drive C:\). Follow the instructions and use the default selected file types in the search. Again this is probably a long shot, but if you have the time to give it a go then you have got nothing to lose.

Good luck.

[GDH]

Recover My Files is designed so that it wont change your drive at all. It finds the deleted files and them makes you save them onto another drive or a CD or USB.

It was designed by people who did Computer Forensics investigations for a living and the last thing that you ever want to do in a forensics investigation is change the content of the suspects drive - so you are safe.

[akniss]

I saw that Shawna had a similar thing happen, so I thought I'd post it here to ee if anyone else has seen it.

In the past week, I have seen two separate computers fail to boot into windows. The first was my wife's HP laptop with winXP SP2. She installed a camera driver, and after the reboot process, a "ntldr is missing" error message came up. We finally got the computer booted into safe mode, did a system restore, and the directories were all back where they were supposed to be. HOWEVER, very few of the files were still there. Conspicuously missing were any MS Office files (.doc, .xls, .pub) or digital photos. Various .exe files were still present, and the recycle bin was still full. When we tried opening any MS Office applications from the start menu, it asked for the installation disks like it had not yet been installed. I used KNOPPIX (a CD bootable Linu distro) and just as with windows, the folders were all visible, but no files.

The second was a friends work Dell laptop with winXP SP2. The computer worked fine, was on the internet and MSN messenger, shut it down, and when he got to work yesterday, Windows would not get past the welcome screen and the Windows Product Activation screen came on, and would not move past it. I again used KNOPPIX to see if we could recover any files in case we needed to reinstall Windows, and all the folders were present. However, again NO MS Office files or digital photos were there. We were able to save all the .lst and .sas files that are associated with the program SAS.

I have see in a couple places on the internet within the last few days similar problems with folders being restored or present without any associated files. Has anyone else seen this? Might I be dealing with some vicious malware? Or is this all purely coincidence?

[GDH]

I dont know of any virus doing the rounds at the moment that does what you describe (but there may well be). Are you able to connect the drive as a slave to a Windows box and then run a Complete Search with Recover My Files. It would be interesting to see if the DOC, XLS etc. are still actually in once piece - I expect that you should still be able to get them all back.

[akniss]

I finally got the adapter to hook the laptop drive up to my desktop to run your software. I did a Complete Search. Nearly all the lost file names were found, but none were previewable (.pub, .xls, .doc are most important t get back if possible). However the rating in all cases was "Very good". I saved the files to a desktop partition, but none of the files I tried could be opened. I'm now optimistically giving the Format Recover a try. Is there any chance that will work, or am I spinning my wheels here?

[GDH]

When you ran a Complete Search for Deleted files did you find files called "Recovered_Word_1" etc. These files are most likely to contain valid data.

The reason is that the full deleted file names are being found is that they are still listed in the Windows Master File Table. They are pointing to locations on the disk, so Recover My Files is going out to those locations and bringing the files back as Word Documents. However, we do not know what this virus has done to your actual files, so what is located on the disk may no longer be valid.

Files called called "Recovered_Word_X" (or any other file in our supported file list) are found by searching over this disk and finding a deleted file that matches the file structure of a Word document (ie. the header, internal structure and footer. Thus, in your situation, they have a much greater chance of being valid files. Did you find any?

I would like to get my hands on your disk to see what this virus has actually done. If you could send me a sample Word or Excel file that does not open, that would be a start.

[akniss]

So, I'm about to give up. I have not been able to open up a single document that the software found. I posted three sample files at the below addresses. The otheres are similar, except they seem to retain their original file size. Some of my wife's Publi**** files that contained a lot of scanned pictures still show themselves as being several MB large (Up to 60 MB in one case).

http://uwstudentweb.uwyo******A/AKNIS..._Excel_113.xls
http://uwstudentweb.uwyo******A/AKNIS...li****_172.pub
http://uwstudentweb.uwyo******A/AKNIS...d_Word_111.doc

On a better note, I have recovered nearly all the data files from my associate's work laptop. They both contain the same hard drive (Fujitsu 40 GB) and had similar symptoms. Things just aren't adding up.