Recovering lost information from a harddrive.

Tiddlypeeps

Important documents went missing from my dad's harddrive about a week ago. They seem to have just vanished, I can't really make any sense of it.

I have tried running a program that recovers deleted files from a HD. I thralled through the list of thousands of files and couldn't find a single one of the files that went missing. There were hundreds of files in the folder that disappeared, I find it very hard to believe that every single one of them have been overwritten on the HD in that small space of time. Especially considering the computer would have been used very little in that week. I managed to find some documents he would have deleted himself from months ago on the HD using that recovery program so I'm pretty sure the program works the way it's supposed to.

The only logical conclusion I can come up with is that the files were removed using a shredder, removing all trace of them from the HD. But I can't see anyone that would have access to the computer doing that, or even having the technical know how to even think of it.

Anyone any ideas how I can try find out what might have happened to these files?

Just for completeness he is using windows 7.

BostonB

Where was the computer who had access to it, or the room it was in.

Tiddlypeeps

Everyone who had access to the house had access to the computer. So just friends and family really.

ricman

try recuva or www.pcinspector.de free file recovery, the best thing is put the drive in a caddy , if the drive is drive c the files can be overwritten
by windows or other programs.
The files may show up as 1.doc, 2.doc etc
if the drive is nearly full theres more chance of them being overwritten.
deleted files can still be recovered .

see here http://www.piriform.com/recuva
do a virus scan first.
installing programs on c: can also wipe out files that are marked as deleted.virus s can delete files without you knowing that you even have a virus.

ArtyM

A few questions....
Have you done a standard search of the drive(make sure all locations and not just indexed ones is ticked and include hidden files and folders) for files types i.e. *.jpg(for pics) or *.mp3(music)
Has anything else changed i.e. desktop background/icons?
Does it look like the space that would have been used by this folder is now free or is the hard drive still showing as though that space was being used?


I ask because the files/folder may be hidden/moved/renamed/corrupt. The deleted file scan would only have scanned for deleted files in the hd free space.
A corrupt or dfferent user profile would result in a totally different personal folders i.e. My Docs, My Pics, etc and can sometimes appear that personal files have been deleted.
Worth checking
Good luck

Tiddlypeeps

I spent several hours searching for the files, searching everywhere and not just places that have been indexed. I even did searches for lines of text that would have been common through out most of the files telling the search to look in the files for those terms. Even then if the files had been renamed it might still find them.

I also made sure to included hidden files and folders in the search.

I have no way of knowing if the space on the hd is still occupied as I have no point of reference from before the files vanished. My dad wouldn't be able to tell me as he wouldn't pay attention to that sort of thing.

Nothing else on the computer appears to have changed.

Thanks for the replies.

Cork Skate

Was it highlighted and dragged into another folder by accident? If you have searched the whole drive then it would rule it out i'd imagine.

Tiddlypeeps

Cork Skate wrote: »

Was it highlighted and dragged into another folder by accident? If you have searched the whole drive then it would rule it out i'd imagine.

Pretty confident this isn't the case. I searched for hours, I had a list of a good few specific file names and most of the folder names. I thoroughly searched the hard drive for them.

BostonB

I think someone doing a secure erase is unlikely. Its more likely that some one deleted the folder by accident, or that there was some disk corruption or a combination of both, perhaps there was a warning, either at the time, or on restarting the computer that was ignored.

A remote possibility, theres a few virus that hide files and folders. Perhaps do some scanning and see if there a virus on it.

Why you'd have important docs with no backup is bit baffling. But ignoring that perhaps theres copies somewhere else, in email, or on a work computer that you could look for.

Tiddlypeeps

BostonB wrote: »

I think someone doing a secure erase is unlikely. Its more likely that some one deleted the folder by accident, or that there was some disk corruption or a combination of both, perhaps there was a warning, either at the time, or on restarting the computer that was ignored.

A remote possibility, theres a few virus that hide files and folders. Perhaps do some scanning and see if there a virus on it.

Why you'd have important docs with no backup is bit baffling. But ignoring that perhaps theres copies somewhere else, in email, or on a work computer that you could look for.

My initial thoughts were that it was just deleted by accident, but there are a few hundred gigs free on the hard drive so the odds of not being able to recover even one of the hundreds of files that went missing are astronomically small.

Some form of disk corruption is also possible, but nothing else has gone missing and windows is still performing as normal. I would imagine everything else would be acting a bit funny if this were the case.

I'll run a virus scan and see if anything pops up.

I'm blue in the face telling him to back up his ****. Pretty sure he has learned his lesson now tho, can't see it happening again. It's not the end of the world, his accountant has hard copies of everything so he won't get in any trouble over this but he will have a job and a half ahead of him if he want's virtual copies of them again.