Recovering Deleted Files

[dazuk1972]

I just caught two viruses and I had to use System Restore to fix my PC. After I got rid of the viruses and when I thought everything was back to normal, when my PC booted up, I saw some files delete themselves from my desktop. All files in my C-Drive that wasn't in a folder have all been deleted by the PC caused by the viruses. The only files I have left are in the folders. Is there a way how I can recover my lost files and if I can, how do I do it. System Restore can't do it because it doesn't touch files and folders, it only touches intalled software.

Many thanks.

[dazuk1972]

Also, when I went into one of my external hard drives, I found nothing in there where all the files and folders have been deleted but under Computer, there's a blue bar under where that hard drive where it shows the data is there. It seems maybe my data isn't deleted, it's invisible. Please help because so far I've lost about 400GB worth of data. Many thanks.

[MilesAhead]

It makes a difference what Windows you are running. If it's Vista or W7 try this:

http://www.shadowexplorer.com/

The trouble with undelete utilities is you need to install them before you need them. Installing will likely overwrite deleted sectors.

Also backup images made by Macrium Reflect can be mounted in Explorer and you can copy folders or files out of them. They are mounted read-only.

You can try Recova or one of the others of that type. There should be a bunch on Softpedia.

Also take a look here:

http://www.techsupportalert.com/best-free-data-recovery-file-undelete-utility.htm

Your best chance may be to create a bootable undelete CD on someone else's machine. The less you use your current machine the less the chance of overwriting deleted sectors. Depends on the type of file whether it's worth undeleting if it's incomplete or corrupted. Video and other binary files tend to be all or nothing. Text files might be worth saving if a sector is missing. Better to have 1/2 your phone number list than none etc..

[dazuk1972]

It makes a difference what Windows you are running. If it's Vista or W7 try this:

http://www.shadowexplorer.com/

The trouble with undelete utilities is you need to install them before you need them. Installing will likely overwrite deleted sectors.

Also backup images made by Macrium Reflect can be mounted in Explorer and you can copy folders or files out of them. They are mounted read-only.

You can try Recova or one of the others of that type. There should be a bunch on Softpedia.

Also take a look here:

http://www.techsupportalert.com/best-free-data-recovery-file-undelete-utility.htm

Your best chance may be to create a bootable undelete CD on someone else's machine. The less you use your current machine the less the chance of overwriting deleted sectors. Depends on the type of file whether it's worth undeleting if it's incomplete or corrupted. Video and other binary files tend to be all or nothing. Text files might be worth saving if a sector is missing. Better to have 1/2 your phone number list than none etc..

Many thanks for the info. I'm using W7. It's worse than I thought because I noticed some data missing from another hard drive. Why did the virus only delete some of my data and not all of it? I don't understand why one of my hard drives has a blue line in the disk space meter indicating about 35% of the hard drive is used and there's nothing in there when I access the hard drive. It's as if the data is invisible as hidden files. I'm trying to find System Properties and reset my settings encase the data is invisible and it might make them visible again. I don't understand why some of my data is missing.

[MilesAhead]

Have you run chkdsk /f on the file system with the blue line? It sounds like something is corrupted.

I've never seen that in 25 years of PC'n.

Once you've been hit bad by a virus like that I'm not sure you can trust anything anymore. You might have to just reformat the drives and take the data loss. Unless you can save some files and verify they aren't corrupted.

Chances are the partition table on the funky drive may have been messed with. I'd be cautious about putting any of those files on a clean system. Maybe if you have a guinea pig machine that you can try then wipe.

[dazuk1972]

Have you run chkdsk /f on the file system with the blue line? It sounds like something is corrupted.

I've never seen that in 25 years of PC'n.

Once you've been hit bad by a virus like that I'm not sure you can trust anything anymore. You might have to just reformat the drives and take the data loss. Unless you can save some files and verify they aren't corrupted.

Chances are the partition table on the funky drive may have been messed with. I'd be cautious about putting any of those files on a clean system. Maybe if you have a guinea pig machine that you can try then wipe.

I haven't run a chkdsk yet. Is it hard to do because it looks as if I need to go in MS-DOS and I'm worried about making matters worse if I make a mistake.

I must add, I know the files are still there in my hard drive and they are invisible. I know this because I was using PC Inspector File Recovery and it located my invisible files and folders in my 1TB hard drive where the entire contents are invisible. When I tried to save a folder of data to another hard drive I was getting some kind of error where it couldn't save all of them. Then the same happened when I tried another set of folders. When I checked things out in the other hard drive with what I tried saving as a recover even though some files were not saved, when I went into the flders they were all empty even though it looked as if it was saving them. I saw MP3 files going though. When I tried saving one single file alone as a recovery it never appeared in the location where I wanted it to be. It's as if the files are reocoving as invisible but the flders are going through. When I did an anti-virus scan, it's showing all my files and folders being scanned that are invisible so I know they are not deleted all the time my anti-virus is still clearly scanning them.

Many thanks.

[MilesAhead]

I'm not a file system expert, but NTFS has MFTs and other structures that track what pieces of file are where, the size etc..

If that stuff is all messed up then unless the file has something convertible to money, like your lost bank account number, it's probably not worth chasing after it. You can try a forum that specializes in file recovery. If they don't try to sell you HD clean room recovery service then you might find out what you can and can't get by software.

Once things are hosed to this point it's beyond my experience. I'd look around at data recovery specialty forums.