# Lost files, Win7 x64, serious issue!



## SaiZo (Jun 22, 2011)

Ok, where to start.. I turned of computer before going to bed last night. All my folders were there. Started system about 54 minutes ago to see - it's all gone. All my projects, work files.. everything - gone. And that's about 19Gb that's gone magically over the night.

"WTF?" that is my only response. I am speechless. This was on a brand new drive, less than 2 months old. They were all in the "Documents" folder. 

Can anyone please help me? I had work that I have been working on for the last 6 months there, and I do not understand what has happened. Is this a nightmare or what?!


----------



## xvi (Jun 22, 2011)

First of all, *do not write anything to your hard drive*

Boot off of your Windows 7 CD, repair, open the command prompt. Try chkdsk c: /f

Edit: Make sure you didn't just accidentally hide all your files.


----------



## SaiZo (Jun 22, 2011)

xvi said:


> First of all, *do not write anything to your hard drive*
> 
> Boot off of your Windows 7 CD, repair, open the command prompt. Try chkdsk c: /f
> 
> Edit: Make sure you didn't just accidentally hide all your files.



See.. now that's the problem, I went to sleep, woke up and it's gone. And there is nothing in the Recycle bin (there were photos there, but that was 2 days ago). Also, yesterday I didn't even go in to the "Documents" folder (Folder created by Windows, not me). Was in the Downloads folder mostly.. I just can't understand..

And what if I go back to when the system was ok? Before last update or something, then what??

I even have "show all" files, even hidden. How can I hide them, if I wasn't even in that folder?


----------



## slyfox2151 (Jun 22, 2011)

if the files are that important with no backups IMHO get some professional help asap. 
i would disconnect the drive.



there are some free recovery programs, there should be a sticky about this in the storage section.
http://www.techpowerup.com/forums/showthread.php?t=142222



i have herd good things about recuava. 



the worst thing you could do right now is write anything to the HDD, that would effectively make recovery impossible for any files overwritten.


----------



## SaiZo (Jun 22, 2011)

slyfox2151 said:


> if the files are that important with no backups IMHO get some professional help asap.
> i would disconnect the drive.
> 
> 
> ...



It's the main drive "C:\". What professional help?

How about this, I found some of the files.. Somehow they seem to be shortcuts, the "shortcut" (what was a folder once) refers to "K:\", and another folder still refers to "C:\Documents\PROJECT\" The folder named "PROJECT" is gone.. Documents folder is still there.. "K:\"??


EDIT: I used an application called DiskDigger, I'll save the files on my scratch disk, disconnect it, copy the files onto several DVD's and then the tech guys have to take a look at my system. Still, this seems to be a W7 issue.

Thanks for the help.


----------



## slyfox2151 (Jun 22, 2011)

if it is indeed a windows issue then an easy fix would be to stick the HDD into another PC and navigate to the files.

i would not use the PC if the files are on C:\ as windows writes to it every so often, so do web browsers for caching ect.





if you can, plug it into another PC and then you can try data recovery all you want as long as you dont write to the drive.

a full disk image would be a good idea first.






the drive could be bad, if it is it may stop working all together.


----------



## kns (Jun 22, 2011)

SaiZo said:


> It's the main drive "C:\". What professional help?
> 
> How about this, I found some of the files.. Somehow they seem to be shortcuts, the "shortcut" (what was a folder once) refers to "K:\", and another folder still refers to "C:\Documents\PROJECT\" The folder named "PROJECT" is gone.. Documents folder is still there.. "K:\"??
> 
> ...



Had you used a pen drive on your system before shutting it down?
Since k:\ may refer to a pen drive or whatever external drive that may have been infected by a virus.
I have seen such shortcuts getting created when pcs are virus infected.
Also sometimes the original files are hidden with system attribute so they wont show up even after doing show all files so uncheck the hide protected operating system files option and see if the files show up.


----------



## qubit (Jun 22, 2011)

It sounds like the pointer in My Documents has become corrupted and is now pointed somewhere else. Because if this nightmare scenario, is why I never use My Documents. I create a separate partition for all my data and call it 'DATA'. This can never somehow get 'lost'.

If it's not a pointer problem, but the files have been physically deleted, then you're in trouble and the advice from others on here not to boot off that drive is good. You'll need disc recovery software to get your data back in that case. It's not foolproof and has a habit of costing a lot of money.


----------



## SaiZo (Jun 22, 2011)

No, "K:\" Was a virtual device. All files were "moved" to temporary internet files (LOW). DiskDigger is now moving all the files to a secondary drive. This drive will then be disconnected, copy all files over to other media for storage.

No files were hidden, they were just moved. The folders needs to be re-created inorder for some applications to function properly. Forget the shortcuts, that's another story. They were not in the Documents folder at all, they were in "Recent" folder.

This is rather sad, there we go buy a brand new W7 license, pay an amount of cash and they spit in our faces "oh, we didn't know about this ourself, we came to know about it from another customer", oh, really? And why not do an update that corrects that issue of moving files all of a sudden?

The system has been running without any issues except this. Virus? Sure, I'll use both ESET and Malwarebytes software to see if there is any virus.

I am more than angry at Microsoft right now.


----------



## SaiZo (Jun 22, 2011)

qubit said:


> It sounds like the pointer in My Documents has become corrupted and is now pointed somewhere else. Because if this nightmare scenario, is why I never use My Documents. I create a separate partition for all my data and call it 'DATA'. This can never somehow get 'lost'.
> 
> If it's not a pointer problem, but the files have been physically deleted, then you're in trouble and the advice from others on here not to boot off that drive is good. You'll need disc recovery software to get your data back in that case. It's not foolproof and has a habit of costing a lot of money.



Thanks for the heads up, qubit. I think that sounds like a wise solution. I'll follow that advice and set it as a golden rule from now on. I do believe it is a pointer problem since it just "moved" the files (DiskDigger found them all - using it right now).

What can I do now, if the pointer is corrupted, all I remember is that last night a Windows Defender definition came along (2,3Mb), could that be a part of the issue? 
Also, one thing - it did not move ALL files from the Documents folder, only the folders I created in it (with the files). The files that are created directly in the Documents folder are still there (strange, huh?).

Well, who ever said that Windows 7 is perfect?


----------



## mrw1986 (Jun 22, 2011)

Honestly, if it was a W7 issue you'd think you would see more people reporting it? I also installed that update last night and didn't have any issues...sounds more like a HDD problem.


----------



## RejZoR (Jun 22, 2011)

If you can, first clone the drive. And don't even thinkof running CHKDSK before you do this. I lost like 500GB of data because CHKDSK decided to "truncate" all the files on HDD.
If you have a perfect clone of your drive you can easily play around without any risk of destroying actual data even if you screw up.


----------



## Red_Machine (Jun 22, 2011)

I feel that people who blame Windows/Microsoft straight away, rather than considering other options, shouldn't be using the OS.

If you hate Microsoft THAT much, use Linux.


----------



## SaiZo (Jun 22, 2011)

mrw1986 said:


> Honestly, if it was a W7 issue you'd think you would see more people reporting it? I also installed that update last night and didn't have any issues...sounds more like a HDD problem.



Well it is not an issue with Windows Defender.. But clearly a windows 7 issue (others have had same problem I have).



Red_Machine said:


> I feel that people who blame Windows/Microsoft straight away, rather than considering other options, shouldn't be using the OS.
> 
> If you hate Microsoft THAT much, use Linux.



Who said I don't? But some software just will not function / is not available for Linux.


----------



## 95Viper (Jun 22, 2011)

Similar problem after the MS Tuesday update, but it was the Pictures folder.
I ended up with "My Pictures" and a couple of extra "Pictures" folders(one actual and one virtual/pointer). And, all my picture files were copied over to the new folder...
I, believe, it had something to do with my re-directing folder locations.  I have re-directed the locations for storage and such, as so, my SSD(OS/Boot = C: drive) is not used for that.

You might wanna look around and see if you have multiple "Documents" and "My Documents" folders now.
Look in explorer under USER, Desktop, and, also, but, it works this way, under C:\Users\Your profile name.

Just thought I would mention it, because, it was sorta odd it happened recently after the updates. Could be related to your problem, if you ran those updates on Tuesday or there abouts.

Goodluck! And, Hope it's not hardware.


----------



## qubit (Jun 22, 2011)

SaiZo said:


> Thanks for the heads up, qubit. I think that sounds like a wise solution. I'll follow that advice and set it as a golden rule from now on. I do believe it is a pointer problem since it just "moved" the files (DiskDigger found them all - using it right now).
> 
> What can I do now, if the pointer is corrupted, all I remember is that last night a Windows Defender definition came along (2,3Mb), could that be a part of the issue?
> Also, one thing - it did not move ALL files from the Documents folder, only the folders I created in it (with the files). The files that are created directly in the Documents folder are still there (strange, huh?).
> ...



You're welcome, glad to help. 

I can't see how that Windows Defender update could possibly have done this. In short, I don't know why it got messed up like that, but it's possible that you did something to trigger this without even realizing it. Also, it's possible that Windows just had a bad moment, I don't know.

However, I can give you some basic tips to vastly reduce the chances of this nasty happening again.

*If you have one copy of your data, you're guaranteed to lose it! Never forget this.* Something will happen, such as a hard disc failure, virus, human error etc. The only way to protect yourself is to have two or more up to date copies of it at one time. Also, it's worth having a slightly paranoid attitude to protecting your data, because if it can be lost, it will.

Therefore, you need a backup strategy. There's no one size fits all solution for making backups, it all depends on the individual/organization and needs. Here's what I do.

I have 4 hard drives:

1 system, with my main Windows on it and other Windows installations. I don't back this up, because it contains no data and I'm willing to go through the pain process of reinstalling Windows if something happens
2 & 3 Two data drives in motherboard RAID 0 - mirror image mode. This gives me an instant backup as I read and write my data, so it's never out of date
4 Hard drive in a separate PC on my home network. Every night, I run  the free Karen's Replicator to make an image copy of the data on the RAID 0 drives. Shortly I will be adding another backup regime, where another partition on this fourth drive gets backed up to every few days, to deliberately have an out of date backup. "Why!" you say? This is in case something important is deleted and I only realize it a while later, I can hopefully restore it

Note that the second PC has two drives in it, the system drive and that backup drive, so it's really 5 drives in all if you think of it this way.

Hope this helps.


----------



## SaiZo (Jun 23, 2011)

95Viper said:


> Similar problem after the MS Tuesday update, but it was the Pictures folder.
> I ended up with "My Pictures" and a couple of extra "Pictures" folders(one actual and one virtual/pointer). And, all my picture files were copied over to the new folder...
> I, believe, it had something to do with my re-directing folder locations.  I have re-directed the locations for storage and such, as so, my SSD(OS/Boot = C: drive) is not used for that.
> 
> ...



You are right.. God damn.. YOU ARE RIGHT! I have "documents" and I have "My documents".. Ok.. what now? How do I get the right one's back? I have run Malware, and ESET, none found anything related with recent actions (moved folders / renamed).



qubit said:


> You're welcome, glad to help.
> 
> I can't see how that Windows Defender update could possibly have done this. In short, I don't know why it got messed up like that, but it's possible that you did something to trigger this without even realizing it. Also, it's possible that Windows just had a bad moment, I don't know.
> 
> ...



Ok, check this out - the "K:\" is a virtual drive, one folder is selected onto it. I was working with a game for ******** *** , and today I was going to continue working with it an voilá - gone.
Just like viper had, it has been renamed, and moved (somehow?). I also looked into the issue if a virus had changed the names with "$", they have not. I managed to get most of it back, but the folder's correct name is "My documents" not "Documents".. Any idea what is wrong here???


EDIT: I have not re-directed any folders.
Should I restore a point (Win7 x64 Ultimate)?

Also the "scratch" disc is where a final "product" ends up, in this case a virtual 'game', but it has disappeared. The company that hired me has some of the most important files however, I always transfer larger files directly to their server, may it be plain documents or CAD files. Last time I u/l around 2Gb of data to their server. I'm getting the tech guy in town to look at my system on saturday, he knows more about this things than I do.


----------



## SaiZo (Jun 23, 2011)

Hey 95Viper, what did you do to restore it? It would be helpful to know how to get things back..


----------



## 95Viper (Jun 23, 2011)

Well, it was a little involved and wierd, because your are working with Libraries.

It is just an opinion right now, but I believe something screwed up and the updates conflicted some software or that something in the updates got confused about the Libraries and actual data storage and moved data to the Library folders it created and thought it was supposed to be in.
Hence "Documents" to "My Documents" and "Pictures" to "My Pictures".
If I remember correctly one was used in Vista and the other was used in Windows 7 at default.  Well, the links below and quotes may help begin to explain some.
And, you need to find the files in the library and put them in the real folder or when the library gets deleted/moved the may go poof(magic sh*t). Have recycle bin on so you can undo anything you do.  Took a couple of tries for me, but I got the files moved back and got rid of the added Library.

Quote from Introducing Libraries@MSDN Magazine:



> Library-Aware Applications
> We want to note that while most applications should work fine with Windows 7 Libraries, there is an opportunity to tap into the Windows 7 Libraries environment to provide richer user experiences. One may wonder what would happen if an application does not support Libraries. Let's imagine an application that, as part of its functionality, needs to save a file to disk. The application prompts the user with the option to select a location for the file to be saved. The user may pick the Documents Library as his or her save "location," since this is where the user usually goes when he or she needs to work on a document.
> However, if the application doesn't recognize that the Documents Library is not a regular folder, the application will try to save the file directly to the Documents Library as if it is just another folder on disk. This represents a problem, since by now, as we already know, Libraries are a non–file system location and therefore can't be treated as regular folders. The application needs to become aware of the fact that they are dealing with Libraries. Luckily, Windows 7 includes an updated Shell API, Libraries API, and updated Common File Dialog that allow developers to handle Libraries properly.



Ah found the info on the two different names used.  IMO, this is what happened to me because I re-directed my storage locations to different from defaults.  But, Windows knew,because I did it through Windows with no fancy BS. Just something was not Library aware in the update or somewhere else.

Quoted from PCMag article Windows 7 Libraries



> Win 7 ships with four libraries already in place: Documents, Music, Pictures, and Videos. Of course, Vista and XP included folders called Documents or My Documents, Music or My Music, and so forth, inside each user profile (and easily accessible from Computer or My Computer), so you might very well ask how Win 7 improves anything here.



Include folders in a library
How to Remove a Included Folder from a Library in Windows 7

Hope this helps you.

Edit: I am not the best at instructing one - doing yes, so if anyone wishes to step in and clarify - please do so.


----------



## SaiZo (Jun 23, 2011)

95Viper said:


> Well, it was a little involved and wierd, because your are working with Libraries.
> 
> It is just an opinion right now, but I believe something screwed up and the updates conflicted some software or that something in the updates got confused about the Libraries and actual data storage and moved data to the Library folders it created and thought it was supposed to be in.
> Hence "Documents" to "My Documents" and "Pictures" to "My Pictures".
> ...



I also seem to experiencing another problem - links. Folders turned into links.. This can't be happening, it's like a curse. Except that the folder (My Documents) was renamed to just "Documents", some of the folders within are created into bloody links. What the heck is going on?! I also started to google that problem.. Seems that has happened others aswell.

There is no virus, no malware.. I ran Malwarebytes then I ran ESET Antivirus.

One of the applications selects "My documents" as standard.. well most of them do.


EDIT: I right clicked a folder and chose properties, there is me with my username, administrator (me that is), and there is an "unknown".. Am I being hacked?!


----------



## 95Viper (Jun 23, 2011)

It is possible, if you had a trojan or virus, it might have compromised your file system or registry somehow, even if you got rid of it you still may have the left over residual damage.

It could be a glitch in windows or an app; or, even, hardware.

Unless, you want to hunt and troubleshoot (which, is fun, if you are into it)... My best advise for a quick and easy resolution would be:

1. back up all the data you want to save
2. Partition and format your drives to clean state
3. re-install windows or any OSes you are using
4. install your A/V and/or Malware programs
5. install all drivers needed
6. install your apps
7. tweak and customize


----------



## Towly (Jun 23, 2011)

You say there is a shortcut to the folder that was present right? To see your hidden files/folders
Tools -> folder options -> View Untick the Hide protected operating system files.
It's probably a virus. And to unhide the file/folders use command prompt: attrib (file/folder name) -r -a -s -h that will unhide the file/folder the properties dialog box to unhide the items is greyd out.


----------



## SaiZo (Jun 23, 2011)

Towly said:


> You say there is a shortcut to the folder that was present right? To see your hidden files/folders
> Tools -> folder options -> View Untick the Hide protected operating system files.
> It's probably a virus. And to unhide the file/folders use command prompt: attrib (file/folder name) -r -a -s -h that will unhide the file/folder the properties dialog box to unhide the items is greyd out.



Yeah.. I googled that yesterday. Doesn't work, and it sure as heck does _not_ bring back the missing folder - i.e. I have links to a folder that does not "exist".
I have not deleted it by "mistake".
I have seen several others over the net with same thing happen to them.
Microsoft have no answers what so ever (they told me actually to do the same you just said). The folder contained other folders, files that were around 19Gb alltogether, they aint there anymore. It just removed that specific folder with sub folders.

Why should it be hidden? Nothing was even in the recycle bin..

I can't seem to find a solution for this problem anywhere.



95Viper said:


> It is possible, if you had a trojan or virus, it might have compromised your file system or registry somehow, even if you got rid of it you still may have the left over residual damage.
> 
> It could be a glitch in windows or an app; or, even, hardware.
> 
> ...



I can't do that. I need to find the damn folder. Also, some of the applications (software), needs to be re-installed then. I do not have the software at hand, all they left me with are the "keys" (hardware type - USB) for them.
A re-install would take me again 2 freaking days, to setup everything.. But I need that folder..

EDIT: What happens when I try to set the attribute is it gives me an "Access denied" message.. Just doesn't work. Doesn't work for me and a lot other people.


----------



## cool_recep (Jun 23, 2011)

There is a virus that hides your files. Funny thing is, you can not view them when you enable "View hidden files".

Because that bastard makes those files look like system files, you also have to disable "Hide protected operating system files".

So, if there is a virus , you will see your files this way.

Another scenario in your case is broken user account.

This time, while shutting down, somehow windows can't save your profile correctly. So, when you boot, windows creates a temp user account for you. So, you can't see your documents.

To see, you have to go to C:\Users\[Your old user name]\documents bla bla...

Hope this helps.

EDIT:

Try a live linux distro like knoppix to reach those files. The virus can't be active on Linux


----------



## SaiZo (Jun 23, 2011)

cool_recep said:


> There is a virus that hides your files. Funny thing is, you can not view them when you enable "View hidden files".
> 
> Because that bastard makes those files look like system files, you also have to disable "Hide protected operating system files".
> 
> ...



And if I use antiviral on system (let it search & destroy), take HDD over to neighbour and mount it on his system (Vista x86), think I can reach it / see it then??

Ok, googled the virus that could be hiding files - not found (most likely erased by AV software). But the rest of the steps does not help at all, some say do this and that in registry.. others say something else.
That's it. It's either gone or something else is "hiding" it. Like I said - found files that used to be contained in the folder, but that's it. Some files still can't be located.


----------



## Widjaja (Jun 23, 2011)

This issue may only be related to your OS and viewing the files through another OS even windows OS may be possible to view the files although you may still have to show hidden files etc etc from the other OS if you can not view with a linux based system.

I have come across a virus like this a few times but I can not recollect properly how it worked.
I ended up finding the persons files under something like (random numbers)_(Username here) in the users folder can't quite remember.
Or the user profile the system directed to became (random numbers)_(Username here) while the original was hidden in the users folder.

Something along those lines.


----------



## SaiZo (Jun 23, 2011)

Widjaja said:


> This issue may only be related to your OS and viewing the files through another OS even windows OS may be possible to view the files although you may still have to show hidden files etc etc from the other OS if you can not view with a linux based system.
> 
> I have come across a virus like this a few times but I can not recollect properly how it worked.
> I ended up finding the persons files under something like (random numbers)_(Username here) in the users folder can't quite remember.
> ...



The tech guy said something that it will be located with either a joker sign "$", and then it will refer to something like a network not there, OR,  just something like "C://username/foldername", where the "//" is where something is wrong..

Most likely _if_ I can't resolve this myself, it will endup at the lab on monday (hope not, some files not made for all eyes).

But this virus, is it able to move encrypted files? I have about 6 or more files that are encrypted with some state of the art application, these files are "were" containted in the projects folder and need to be found once again.


----------



## Widjaja (Jun 23, 2011)

^^ Something along those lines but I am pretty sure the username was still there.
I think I found the renamed user profile folder by using another machine.
I remember them being Vista OSes which had the issue once infected.
Possible it could happen to WIn7 too.
I came across this type of infection about half a year ago maybe more.

You will also noticed that your HDD still states it has the same amount of data in there so you know it is definitely there.

Yes the virus will be able to move everything contained within the folder.
I just have this feeling it has been renamed something else and a fake user profile with nothing in it has been put in it's place.

As for the NSFW data on your drive, most of us people who have done data recovery as part of our job have seen it all.

I once had some dude who came off the internet cafe asking me to retrieve his missing data.
He didn't say what it was out loud, instead he showed me what the name of the folder was.

Shemales and Wrestling.


----------



## SaiZo (Jun 23, 2011)

I can't say _what_ it is, since it does not even exist (does not exist right now that is), there are numbers and letters to the encrypted files (working files). When one project is done - send it to the office. The problem is however - I have just been over to neighbours house, tried using it on his Vista, still can't find the damn folder.

I have noticed this, and I have noticed that sure.. But since I do not have any virus left as said, I have tried 3 more AV programs and all come up blank - _where_ is the folder?, do belive it has been renamed, moved whatever, but not deleted... But seriously.. if anyone can give me some tips on what to do, then please help.

And what is NSFW data?


----------



## Batou1986 (Jun 23, 2011)

You could try combofix it finds stuff others miss.

In your case i would download Hirens boot cd  boot mini xp backup anything you can to another storage device if you have one, if not use a partition editor to make a new partition on the drive temporarily.
Anything you cant backup normally you should be able to use the programs on the Hirens disk to recover them, tho you might have to save them in a new location on the main C:\ drive if your using usb backup device.

After recovering/backing up whatever you can to something else I would use the programs on the Hirens cd again like @Active kill disk or whatever works for you to write zeros to the drive.
Then run memtest86+, HDD test etc before reinstalling Windows.

Unless you have already established its not caused by settings in whatever programs your creating documents in that is.


----------



## SaiZo (Jun 23, 2011)

Batou1986 said:


> You could try combofix it finds stuff others miss.
> 
> In your case i would download Hirens boot cd  boot mini xp backup anything you can to another storage device if you have one, if not use a partition editor to make a new partition on the drive temporarily.
> Anything you cant backup normally you should be able to use the programs on the Hirens disk to recover them, tho you might have to save them in a new location on the main C:\ drive if your using usb backup device.
> ...



What exactly do you mean "what others miss"? I have tried DiskDigger and Recuva, best program was Recuva - did manage to salvage pieces of data, but ofcourse not the most important files. According to the techie over at the office, the encrypted files that was located in the projects folder _cant_ be renamed, the user must have the USB hardware-key to unlock it to make changes, alter it etc. Still can't find it..

Ok, let's say _IF_ something changed places, names etc. is there anyway I could get some sort of informative application that can tell me what was created /altered by date, time etc?? Then I could perhaps have a 50-50 chance of trying to locate the folder or files myself.


----------



## D007 (Jun 23, 2011)

I'd run some basic maintenance, defrag, system cleanup and ccleaner registry repair. System restore isn't such a bad idea either if you installed something that may of messed up your system.
gl


----------



## 95Viper (Jun 23, 2011)

SaiZo said:


> I have about 6 or more files that are encrypted with some state of the art application



What was the name of this state of the art encryption app... if you don't mind saying.

I remember, a while back, RuskiSnajper was having trouble, with his folders and files dis-appearing in a thread on this forum after he used "Folder Lock" software on his folders and files. 

Try the safe mode fix he did in the quote box of this post.

This, maybe, from the quote: 





> Go into safe mode, turn on explorer for hidden files, find the folders and, yep, you guessed it, open them ALL RIGHT UP.



Again, Hope you get it fixed...


----------



## SaiZo (Jun 24, 2011)

95Viper said:


> What was the name of this state of the art encryption app... if you don't mind saying.
> 
> I remember, a while back, RuskiSnajper was having trouble, with his folders and files dis-appearing in a thread on this forum after he used "Folder Lock" software on his folders and files.
> 
> ...



Name?? I think it's called "Blowfish", it's part of the application, or an addon. I did not install it, nor did I install the application itself. They did, I do only have the license to use it.

Ok, I shall try and see what I can do. Just spoke to one of the tech guys at the office this morning, he say that _if_ the folder with the encrypted files are moved - it can be hard for "someone like you" to find it. Nevermind that, I get more help from all of you than they could ever give.

I have found fragments scattered across the drive, for an example:
At the start the folder(s) layout was like this:
My Documents (or Documents) -> PROJECTS
->ACAD
->LW
->M3D
->EWB
->Work files (in this folder several sub folders):
->Prototypes ->Schematics ->Blueprints
->CAD ->Demonstrations ->Video
->Mechanical
->Electronics
->Materials
->Send
->Recieve
-->E-Books ->Manuals
And so on (not in the given order, but similar). Not all folders have data in them, some are empty.

I have thanks to "Recuva" been able to find around 20 files, and check this out - some were renamed, but not the file ending (still could be opened), managed to get two of the nine files that was encrypted back. Could even open them so they are not damaged (and yes, I have secured them on a DVD and an USB drive just incase something weird happens).

But it would help me even more if I just could find the entire folder. Somehow it feels that this is something too advanced for me. I have not worked with computers in a way that makes me good at knowing what to do in situations like this

Thanks again for the help.
Just a question, should I erase the HDD, get a new one and get the OS installed on that one instead? Might be something with the HDD itself..


Now I'm going out, grab a beer and just forget this day..


----------



## SaiZo (Jun 24, 2011)

Hey.. wtf.. I just did that "SHOWALL" "NOHIDDEN" thing in the registry, now I see other folders with a "lock" on (no, not me that did that, not the software that I use, it only encrypts files).


----------



## SaiZo (Jun 24, 2011)

Ok, found something interesting..
In C:\Users\<username> I found following:
NTUSER.DAT
ntuser.dat.LOG1
ntuser.dat.LOG2

NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf

NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms

NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms

What are these? They were hidden, until - well I removed the "hide all" thing. I do remember seeing the NTUSER.DAT from older OS, but the rest??

I was planning on giving a picture of it, but I can't seem to find controls to upload an image here.


----------



## SaiZo (Jun 25, 2011)

Guess I'm on my own..


----------



## Widjaja (Jun 25, 2011)

Sorry but I personally don't think this can be done from your OS as I think it is infected and been corrupted.

I personally would have immediately taken a look at the drive data from another OS.

Recuva was given a try and did find some of the data which it does but checking from an uncorrupted OS would have been the best bet personally.

So when you can do so.


----------



## 95Viper (Jun 25, 2011)

SaiZo said:


> Hey.. wtf.. I just did that "SHOWALL" "NOHIDDEN" thing in the registry, now I see other folders with a "lock" on (no, not me that did that, not the software that I use, it only encrypts files).



News flash, anything from a sun spot to misbehavin' software to hardware can cause data errors.
However, sometimes they can be fixed... sometimes it gets to a point where you need to save what you can and start over!

Your best bet... is to:
Save you data
Secure erase your personal stuff (games,data, home videos/pics , and those other videos/pics, etc.)
Then, tell your IT guy/girl the thing don't work and would you please fix it.




SaiZo said:


> Ok, found something interesting..
> In C:\Users\<username> I found following:
> NTUSER.DAT
> ntuser.dat.LOG1
> ...



Ok, here is what is going on, IMO, your registry is hosed/screwed-up/corrupted.
Your Junction Points are screwed/scre... (you get the idea).
A little more background here on the Junction Points:

Junction Points
Robocopy warning, if you use it, just some FYI for others.


You can try re-setting your libraries back to default and cross your fingers.
To do this:
1. Open explorer
2. Right click on the "Libraries" folder
3. Click on "Restore Default Libraries"
4. Done, so far

Now, the files in your quote are:





> NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
> NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regt rans-ms
> NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regt rans-ms



These files are generated by Windows.  NT user DAT files store your info for password, settings, and other things.  The regtrans-ms files are files connected to the NT DAT files and are used as pointer to the registry hive location.

If you wish to clean them up; you can do this(which is from MS web site):



> To do this, follow these steps:
> Log on as an administrator.
> Click Start, type cmd in the Start Search box, right-click cmd.exe in the Programs list, click Run as administrator, and then click Continue.
> At the command prompt, type the following commands. Press ENTER after each command.
> ...



Just some info FYI:  
Managing User Profiles



SaiZo said:


> Guess I'm on my own..



Naw, we come ond go on here; however, we are not 24/7, we need to live life, eat, sleep, have sex, etc.
_______________________________________________________________________________________

Goodluck, however, IMO, you are beating a dead horse.


----------



## SaiZo (Jun 25, 2011)

95Viper said:


> News flash, anything from a sun spot to misbehavin' software to hardware can cause data errors.
> However, sometimes they can be fixed... sometimes it gets to a point where you need to save what you can and start over!
> 
> Your best bet... is to:
> ...



Well, I do not like to give up on things. I will find it..


----------



## 95Viper (Jun 29, 2011)

SaiZo said:


> Well, I do not like to give up on things. I will find it..




Great, let us know the outcome or what you do to solve it.


----------



## SaiZo (Jul 21, 2011)

95Viper said:


> Great, let us know the outcome or what you do to solve it.



Forgot to even answer.. duuh..
It worked, and the best program I found was Recuva.
Just a note, for those who have never used i - get an extra disk. If you try and recover on to the same disk, it just "might" go wrong (i.e. most files endup dead somehow).


----------

