File recovery after system recovery?

One of our students has a laptop that has had a system recovery performed on it by someone else by holding the zero key while pressing the power button. I'm trying to see if any file recovery is possible using standard forensic tools or suites. I haven't been able to find out exactly how the system recovery process works so I don't know what I have to work with. Does anyone know how the original partition is cleaned up before copying the files from the hidden backups?
Thanks in advance for any help or information you can offer.
Bill
[email protected]

Same thing happened to me except that they were audio MP3 files. Where did all those WAV files go?

Similar Messages

File restore after system crash?

I recorded several videos on my iPhone yesterday. One was 28 minutes long (almost 3 GB) so I deleted them from my phone as soon as I copied it into iPhoto. I was viewing the videos in iPhoto when my system crashed. After rebooting, the movies were gone.
Is there any way these movies can be recovered? They've got to be on the hard drive somewhere.

Try using a data recovery product such as the ones listed here. Don't write anything else to the drive until the files are recovered or you choose not to recover them.
(118650)

No file sharing after system update

Yesterday, I performed a System Update. Since then, my Z61t has not allowed file sharing on my network. Prior to and after the update, I have made no configuration changes to my file sharing settings. I have checked the settings, and they are proper. I have tried unsuccessfully to stop and restart sharing. The Z61t and its shared drives and folders can be seen from other network computers in their respective My Network Places, but when trying to connect to any shared drive or folder of my Z61t, I receive an error message. The error message states that the drive is "not accessible." It also states, "You may not have permission to use this network resource," and "Not enough server storage is available to process this command." Not even the Shared Documents folder is available on the network. This is not a firewall issue, because I have tried unsuccessfully to connect with the firewall turned off.
Will some kind soul please help me determine what the problem is and how to fix it?

Try if your network works ok.
Start command promt in Z61t
type ipconfig
Start command promt in your other pc
type ping "ip addred of z61t"
IF this fails your network is not ok or firewalled.
also try to disable simple file sharing from folder options.

Previously deleted files reappearing after system updates

I have an AFP/SMB share on a G4 Xserve accessed by ~50 users. For the second time (first after upgrading to 10.4.5 and then again to 10.4.6), I have folders and files that have been moved or deleted weeks to months ago that are reappearing in this share. Has anyone else seen this? Any ideas what could be going on? Thanks for any help...

OK, a little more information here...
It seems to be more related to restarting the server than to actually updating, and it seems to be only in areas of the share where permissions had been stupidly set - the POSIX owner was a local server admin (NOT an OD user), and the ACL was set to allow a group of OD users Read & Write access. Could the local owner somehow be preventing the OD users from deleting stuff, even though it appeared to delete, and without generating an error?
I did run DiskWarrior and didn't find any significant problems in the directory. I am completely baffled here... never seen anything like this happen before, so if anyone could shed some light I would REALLY appreciate it.

After System Refresh Variants missing

Hi,
We have used Export / Import method to build QAS system from production
ABAP export file.
After System refresh we got the same Production client with all
configurations, Variants, Object including data.. Which is Perfect.
But, as per our business we don't want to use the same production
client number in Quality System., so we done Cliet Copy to copy to
different client (ex: Client 200) using SAP_ALL profile.
Question: But after client copy we found that some Data, Objects,
Variants are missing in the new client (200).
Ex: In Client 100 (Copy of production client) table T009 is having 10
entries, but after client copy in client 200 the same table doesn't have any
entry in that including standard and Z.
Please help me on this, how do I get clone / copy of 100 client
(original client)
Thank You,
Ramesh

Hi Ramesh,
Looks like your client copy didn't bring all the data and Objects, Did you checked logs, Is there any error message ? The client copy completed with all the tables ?
You can try Remote client copy method .
You can manually export the variants from the source client to Target client and you need to export the Variants from the table VARID, VARI, VARIT and VARIS.
You can use the below forum procedure to export and import variants.
how to export RFC destination to file in order to import it in an other sys
Since, not only the variants you are missing data and Objects, I would suggest for re-copy the client.
Regards,
Arjun

Lost Quickbooks data after System Recovery

Is there anyway to recover Quickbooks data after system recovery?

Quickbooks is an accounting tool designed and marketed by the Intuit Inc. mostly used for financially-related processes anywhere in any big or small organization. So, financial means quite important and very useful data to store..so there are number of possibilities of QBW file or QuickBooks database corruption.
Read More: http://www.filesrecoverytool.com/quickbooks-recovery.html
use free trail version demo

After system recovery on a Pavilion 513n with XP SP2 I cannot run CD's created with Iomega Hotburn.

I have a 9 year old Pavilion 513n running Windows XP SP2. I have two RAM sticks, one of 1GB (added) and one of 256MB (the original with the computer). The hard drive is a Western Digital 80 GB. The CD/DVD drive is the original with the computer. I recently had to do a system recovery due to a corrupted Windows file using the HP System Recovery Disks and an SP2 disk from Microsoft. Since then, the computer will not recognize nor read CD's created on an Iomega external CD burner using Iomega Hotburn software. These CD's worked fine previously even after system recoveries. Other CD's run fine. I have done previous system recoveries in the last nine years, and have never encountered this problem before. I am hoping someone else may have run into this and can help me.
Thanks

I think this problem is more of a hardware issue. Have you tried using a linux live cd?
If it boots fine into safe mode then it is an installation/driver issue. Safe mode bypasses most driver problems. I would suggest you try using virtual pc from microsoft it is free and try it withing windows it is very, very easy to use to set up a virtual machine.
It COULD be a hard drive issue, if so i would try a low level seek format, and then install windows. Low level formats are NOT windows formats. Try installinf say PCLinuxos 2007 and if that works there is a problem with your drivers.
Ultimately it may well come down to hardware, just use other options to actually isolate if it is a hardware problem or not.

File Recovery System in Adobe illustrator

I have some problem with my UPS i am using. In the middle of the work if the electricity goes off then i lost all of my design work. And also while using my navigator tools sometimes my illustrator stops working. So i think illustrator should add more care about the file recovery system like Microsoft word document

Earfan,
CS5/CS6/CC & Vista/7/8 or 10.7+ Intel only
http://www.astutegraphics.com/software/autosaviour/

Installing software is happen and reboot nearly one day after system recovery.

HP installing software is happen and reboot nearly one day after system recovery.
I have done the recovery for my lap
1)After recovery done system get reboot and hp software installation menu has came.
2)HP software get installed , and then rebooot.
3)This HP software installation menu is come and reboot the pc and again it come. it doesn't finish
this is running more than 24 hrs.
4)please guide to resolve the issue.
System Model: HP Pavilion dv5 Notebook PC
Operating system: Windows Vista Home Premium
Please use the link to download the video of my problem, which used understand the issue:
https://www.dropbox.com/s/bf7e08lmdrn32t1/HPSoftwareInstall-1.rar
https://www.dropbox.com/s/4k4rug8pvs3w6qu/HPSoftwareInstall-2.rar

Satellite C75D-A7370
ordered recovery media from Toshiba and installed it. .... I tried to call Toshiba support, but because I am outside my warranty, I was told I would be charged for support.
It is running Windows 8..even though it is supposed to be on 8.1 (according to the sticker on the bottom of the laptop).
The product key is buried in the hardware.
According to the spec above, the original model shipped with Windows 8 and needed to be upgraded. My guess is that they later shipped the same model with Windows 8.1.
It appears Toshiba shipped the wrong recovery media.
Explain that when you call.

Empty directories after system recovery

I did a system recovery, then recovered backuped files with RecoveryMgr.
That program claimed that it placed the files into c:/system recovery files,
but I couldn't access those files. Please help. Thank you,
Adrian

Hello thats the behaviour of 10g RMAN when you backup it cleans up the backed up files not the directories. If you want I have small shell script that does cleanup empty directories :)
-Sri
<< Fix.sh >>
#!/bin/ksh
# Author: Srikanth Pulikonda
# Date: 20-Feb-2006
# Purpose: This script will check empty directories
# in archive destination and clean them up.
# Local variables
bkdir=/u06/oradata/SRI/flash_recovery_area/SRI/archivelog
echo ${bkdir}
echo " "
# Loop through all directories and check for empty directories
for i in `ls -l ${bkdir} | grep -v fix.sh | awk '{print $9}'`
do
fname=`ls $i`
files=`ls $i | wc | awk '{print $1}'`
if [ $files -eq 0 ];
then
echo "No files in folder: $i"
echo "Files Count : $files"
echo "Filename : $fname"
echo "Action : You can delete this directory $i"
echo "Now cleaning up the empty directory..."
rmdir $i
else
echo "There are some files : $i"
echo "Files Count : $files"
echo "Filename : $fname"
echo "Action : You cannot delete this directory $i"
echo " "
fi
done

File Recovery Question

Hi there, before I ask my question, let me explain my situation:
I lost all of my data off my hard drive partition, and used the program "Stellar Phoenix Macintosh 4.0". It is a recovery program that allowed me to view and retrieve my lost files from my deleted partition.
It managed to recover EVERY file in its original file structure.
Now, when I try to view pictures, play songs, or do ANYTHING with these files, they don't work, however the FILE SIZE makes sense: Pictures are 1mb-5mb. Songs are 2mb-15mb, etc.
For example: I get this error when trying to view jpgs:
The file filename.jpg could not be opened.
It may be damaged or use a file format that Preview doesn’t recognize.
I changed the permissions on the file so everyone can "read & write" but that still didn't help. I tried copying the files to another drive, but still no luck.
If someone could help me either with making the files readable, or a different setting on the recovery program, that would be great.
Is it possible that the files were viewed in 10.6.2 and I recovered them in 10.6.0?
Any suggestions would be appreciated!

30 day trial, no money spent.
So why would anyone buy this Keith, if they could get full use out of it for up to 30 days, when just 30 hours would probably do ? Excuse the rhetorical question.
What is noticeable about the various file recovery programs is they let you sample them but mostly require payment if you want to seriously use them.
It is remarkable in the software universe of freeware, and OpenSource ware, that software recovery are the exception and give no free lunches, or at least none that I know.
*I suspect you will have to pay for this app to facilitate your file recovery*.
I'm not sure which one, but there is one that lets you restore one file, just to prove itself, but to get the rest you have to buy the software. Can't remember which one that is but see if you can find it, at least to prove something is recoverable before you fork out the money.
On the matter of creating a backup image using Disk Utility, did you do it according to these procedures?
http://support.apple.com/kb/HT1553
Still, if it has no mountable file system, I doubt if it can be created after the fact.
Sorry to be unable to throw some sunshine on your problems, but gee you are gonna have a great backup strategy in place after this. ...a little ray there.
P.S. You need to contact the providers of these software to clarify things - your expectations, payment, whatever.
Message was edited by: roam

Possible file recovery for Excite AT300

Unfortunately my AT300 started freezing up during startup and I had to face the invetiable and do a factory reset after two years of usage. Unfortunately I didn't back up anything. My main concern was after resetting it was that I had lost text files of writings etc. I am wondering, however, is if it is even possible to recover anything after a factory reset? The only thing I could think of would be to attemp to connect the tablet to a laptop and try to use file recovery software if the laptop can even acknowledge the AT300. Has anyone attempted this?

30 day trial, no money spent.
So why would anyone buy this Keith, if they could get full use out of it for up to 30 days, when just 30 hours would probably do ? Excuse the rhetorical question.
What is noticeable about the various file recovery programs is they let you sample them but mostly require payment if you want to seriously use them.
It is remarkable in the software universe of freeware, and OpenSource ware, that software recovery are the exception and give no free lunches, or at least none that I know.
*I suspect you will have to pay for this app to facilitate your file recovery*.
I'm not sure which one, but there is one that lets you restore one file, just to prove itself, but to get the rest you have to buy the software. Can't remember which one that is but see if you can find it, at least to prove something is recoverable before you fork out the money.
On the matter of creating a backup image using Disk Utility, did you do it according to these procedures?
http://support.apple.com/kb/HT1553
Still, if it has no mountable file system, I doubt if it can be created after the fact.
Sorry to be unable to throw some sunshine on your problems, but gee you are gonna have a great backup strategy in place after this. ...a little ray there.
P.S. You need to contact the providers of these software to clarify things - your expectations, payment, whatever.
Message was edited by: roam

FF 34 - Restoring Sessions from old folders of files recovery.bak and recovery.js that are not in the original folder. Is this possible?

After crash all the recovery files were gone. With a recovery software I could get old versions of recovery files (recovery.bak, recovery.js). I try to implement them in the new profile folder by exchanging the files, but FF34 just ioverwrites them. Unfortunalty I could not restore the old sessionstore.js file.
Any idea how I can restore the ols session with this 2 old files (recovery.bak, recovery.js)?

Did you check in a text editor that the recovered files are not corrupted and only contain ASCII text?
You would have to copy such a recovery file to the main profile folder as sessionstore.js to replace the current copy.
If you do not use "Show my windows and tabs from last time" then you need to use "History > Restore Previous Session" and possibly "History > Recently Closed Tabs/Windows".

Third Party File Recovery

I was currently working on a video project, using FCP with a few friends. When I woke up the next morning the project file was in the trash. I removed the project file from the trash and put it back on the computers HD and an external that I am using for the video project.
When I open up FCP to start working on the project a bunch of the video files were not connected anymore. Not sure how this happen, I cant find the files anywhere!! I have heard about third party file recovery systems that allow you to get back files that were deleted. Can anyone shine some light on this topic for me.. I need the media that is missing badly.
Thank you

ERizzal wrote:
*I never really deleted the folders that were put in the trash.* I removed the folders and put them back where they were. Do you have any ideas where they could have gone?
Hi Eric, Hmmnnn, If you never deleted them then they should be there someplace. Try the Spotlight and / or *Cmd f* is all I can think of.
Best Regards, JP

Windows 7 Offline Files Recovery

Thanks for all your help!
Facts: Domain Network, Server 2012, Folder Redirection Enabled (Docs Only), Shadow Copy Enabled, Windows 7 Clients
I have a domain user who was not syncronizing with the server through Folder Redirection. We deployed a GPO to disable Offline files and sure enough, she reported that her files went missing. We looked at the Shadow copies only to find that the folders are
in fact empty.
Attempts: Shadow Copy, HBCD (to access the CSC folder offline, turned up empty)
Are there any tools or techniques that I am missing here to recover her files? Remember this is Windows 7.
All your help is much appreciated.

Hello all,
Just thought I should come back and share my findings.
FolderRedirection can be a useful tool, but can be a pain if used or removed improperly. I found that permissions can play a role in Syncing documents, if permissions are modified for whatever reason in the server, it will not always sync properly and the
user will mostly not notice. This will cause your system to hold "temp" files on your pc.
I had success with Recuva for file recovery but mostly the classic HBCD, this allowed me to browse the contents of CSC without hassles, and move to the local drive. The particular machine in question did not turn out successful, but these methods worked
for the remaining.
Thanks to all for your help.

File recovery after system recovery?

Similar Messages

Maybe you are looking for