In need of serious computer help

[erik316wttn]

Last night, my wife discovered that all of her Microsoft Word files that were saved on the desktop were gone. Well, I did a seach, went into her "Documents and Settings" folder and retrieved them. I put them all back in a folder on her desktop, and stupidly left it at that. I know, I know, I should have backed it up on a flash drive. I'm a big moron. I get it.

However, tonight we find they're gone. I did a search, they're not in her "Documents and Settings" folder, they're not anywhere. My word files on my account are all there, but hers have dissapeared. Is there any way they can be retrieved? I'm not much of a computer guy, so jargon-free answers would be much appreciated. She's freaking out. She had her resume on there as well of a lot of Documents for school.

[Der Cute]

Uh, who used the machine?


Do another search for *.doc *.txt *.rtf *.xls......get the idea.
Look in Hidden files & folders
Look in Subfolders

You can also do a search for anything MODIFIED in the last few days... *.* and change the Advanced search for MODIFIED in last 4 days.

That will pull a lot up..

But... WHO THE heck was on the pc?

Cutenoob

[draggar]

There are some great data recoverey tools out there but I'd also recommend running a GOOD virus scan (not crap, like McAffee or Norton).

AVG is a good (and free program), http://housecall.antivirus.com is a very good "on the fly" scan

Also, get Spybot: Search & Destroy and Ad-Aware SE (all free) for malware checks.

If your wife isn't deleting them, there are viruses out there that can do this. Best bet is to install them, update then, then reboot into safe mode and scan the heck out of your system.

[erik316wttn]

Uh, who used the machine?


Do another search for *.doc *.txt *.rtf *.xls......get the idea.
Look in Hidden files & folders
Look in Subfolders

You can also do a search for anything MODIFIED in the last few days... *.* and change the Advanced search for MODIFIED in last 4 days.

That will pull a lot up..

But... WHO THE heck was on the pc?

Cutenoob

Nobody has been on the computer except for my wife and I.

Unless someone broke into my house while I was out running errands, went into my wife's account, and then deleted her crap and then left without taking any valuables, etc.

[Pedersen]

Here's the least technical way I have of describing it: With the way Windows works, every program you click to run, you run the risk of deleting those files beyond recovery. Every single one. (for you techies, I'll justify this statement at the end).

Use a different computer, and download a data recovery tool. This one looks promising. Others are out there (google for "undelete ntfs file"). Get that data recovery tool installed onto something else (bootable cd, usb drive, doesn't matter). Then run the tool from that other media. Act quickly, and make certain you make backups of any documents you do recover.

Until you do this, do not install any antivirus software, or any spyware detection software, or anything else. Don't even visit another webpage. Every bit of activity on that computer runs the risk of losing whatever can be recovered.

Of course, once you've recovered what you can, get your antivirus up to snuff, and your spyware detection, too.

Techie Talk: Look, we all know that deleting a file doesn't actually delete the file. It just marks the space on disk as reusable. Now, take a system like Windows, and go with the default settings, which allow the swap file size to be managed by Windows (OSX is guilty of this too). If the OP does anything which causes the swap file to grow, it can overwrite that space. If he does anything that causes new files to be created (such as cached internet pages), he can overwrite that space. Basically, almost everything he can do can cause that space to be overwritten, losing any hope of recovering that data.

Out of techie talk: Good luck with this. And I hope you don't need it.

[Geek King]

Just curious, but has the recycle bin been checked? If its not malware, they might be in there.

Also, was it the documents themselves, or shortcuts on the desktop? If shortcuts, do you have multiple drives? You could have a drive not being picked up by the machine on boot up, which can cause shortcuts to dissappear on some OS. It would also make a search fairly useless, as the drive can't be searched.

[CorDarei]

does system restore return deleted docs? i don't recall if it does or not... but you could try that.

[sms001]

Erik.

Hope I can help. To make it a bit easier on you, I'm taking everyone's salient points and combining them into one post.

The most important thing at this point is to change the state of your machine as little as possible! Do not turn off and on, do not log off and on, do not write to the hard drive.

If the OP does anything which causes the swap file to grow, it can overwrite that space. If he does anything that causes new files to be created (such as cached internet pages), he can overwrite that space.

Glad Pederson brought this up - it's the first thing I do in iffy data recovery operations - move the temp and swaps to a different drive.
(More on this after your next reply.)

Last night, my wife discovered that all of her Microsoft Word files that were saved on the desktop were gone.

I hope you don't mind, Erik, but I'd like to ask a few questions. I assume from the "Documents and Settings" reference that you are using Win XP?

Only two users on the machine - do you both log in and out whenever you want to use it?

How old is the computer?

Do you have only one hard drive?

I assume also that you have a USB Flashdrive? Enough capacity to recover everything to once you get that far?

Any other changes that you've noticed in the past couple of weeks?

erik316wttn:
However, tonight we find they're gone. I did a search, they're not in her "Documents and Settings" folder, they're not anywhere

What happened between finding them and this? Machine turned off and back on, change in logged in user, running a particular program?

Cutenoob:
Do another search for *.doc *.txt *.rtf *.xls......get the idea.
Look in Hidden files & folders
Look in Subfolders
You can also do a search for anything MODIFIED in the last few days... *.* and change the Advanced search for MODIFIED in last 4 days.

What did these searches turn up?

Geek King:
Just curious, but has the recycle bin been checked? Also, was it the documents themselves, or shortcuts on the desktop? If shortcuts, do you have multiple drives?



On to the particulars.

1. DO NOT WRITE TO THE HARD DRIVE(s)!
Don't "save" shortcuts, documents, pictures, download programs, ANYthing to the drive that contains the missing documents.
Don't copy anything from one folder to another on the hard drive.
If you must save something (notes from this thread for instance) save them to your flash drive.

2. To perform the requested searches most thoroughly:
Click START
Click SEARCH

In the left hand pane of the Search window there is a drop down list under "Look in." Make sure that everything there is as it should be - no drives missing, etc. For now, Select "Local Hard Drives"
Under the "Look in" area there is a hyperlink for "Search Options" Click it to expand the selection box.
Look in the expanded box for a hyperlink for INDEXING SERVICE. If it says "enabled" Click it and Click on the radio button that disables it. Click OK in that window to return to Search.
Click the Advanced Options selection box.
Make sure the following HAVE checks in their selection boxes:
Search system folders.
Search hidden files and folders
Search Subfolders
NOW scroll up and enter your search term in the "Search for files or folders named" text entry box. Cutenoob's *.doc is a good start.


Please let us know the answers to the italicized questions and what your search turned up - especially if you are finding documents but not where you expected them.

Good luck and looking forward to round two...

sms001