Re-installed windows - lost everything - can I get it back?

LottyB

Hi there
Hoping someone can help.
I'm posting on behalf of my sister as its her laptop which has lost stuff.

She turned her laptop on the other day and whilst using it a message cam eon the screen saying that she needed to re-install windows (my sister is not very computer literate and did suspect that this could be something malicious). Anyway she re-installed windows and has now lost everything on there - mainly photos (some of which were of her daughters birth & first Christmas). Is there any way that these files are still on the computer and can be retrieved?

Once I have got her sorted I will make sure that she has some anti virus software installed (I think she had some on when she bought ot but it was only for a few months after which time she was asked to pay for it and so she never did). I'll install AVG I think.

I think I'll need to re-install her links to allow her to get access to the internet too, but I'm hoping I can follow the initial installation instructions to get this back working again.

If anyone can suggest how/if its possible to retrieve these photo's I'd be really grateful.

Many Thanks in Anticipation

Lotty

busenbust

She turned her laptop on the other day and whilst using it a message cam eon the screen saying that she needed to re-install windows (my sister is not very computer literate and did suspect that this could be something malicious)

Depends on the type of reinstall she carried out; dig deep into the c:\ root folder; see if you can find any remnants of folders (sometimes labeled as .001, .002 etc). Do a search for a specific file name - and that will give you the location of any docs/photos etc.

I strongly suggest you install a reputable anti-virus and anti-malware solution such as Avast and Windows Defender. I would, IMO, also do a quick scan with Malwarebytes. Make sure the Windows firewall is also on.

HTH.

JasX

busenbust wrote: »

I strongly suggest you install a reputable anti-virus and anti-malware solution such as Avast and Windows Defender. I would, IMO, also do a quick scan with Malwarebytes. Make sure the Windows firewall is also on.
.

afraid it really doesn't look good for recovering her files, she could try downloading recuva a freeware undelete utility to look for any remnants of them on the hard drive -important to run that from a USB key and anything she does on the laptop since the reinstall that involves writing to the hard drive reduces further the chances of getting stuff back (eg installing anything, downloading anything, copying anything onto the drive, internet browsing -filling up temp files and cache)

also echo Bunsen;s advice about choosing a decent AV for her (AVG is tat these days -search and look at the number of problem posts about it on here)) Avira is good, as is Microsoft Security Essentials and Avira (so long as Avira have solved the issues they were having with their update servers). If she banks with Barclays she can get Kaspersky for free too as another option.

make sure she is setup to automatically get the latest security updates from Microsoft too.

busenbust

make sure she is setup to automatically get the latest security updates from Microsoft too.

Oops, forgot about that. Thanks Jas

davb

As the others have said, use something like Recuva to try and get the files back.
The less the laptop is used, the more chance you will have of getting stuff back. Recover any files to an external drive, NOT to the drive in question. You could also remove the hard drive and put it in a USB caddy which could then be attached to another PC - this would minimise any further disk writes, by running Recuva from that PC, and recovering any files to it.

This will give you the best free shot at recovery. The best paid chance would be a specialist data recovery company (not PC World) who have the tools to do a lot more - but expect to pay a few hundred pounds.
There are no guarantees in this type of thing, but there is still a chance.

LottyB

Thank you to everyone who has replied.
I did make sure that she didn't use the laptop at all after she told me what had happened so with a bit of luck there will have been very little new stuff saved to the hard drive and she can't currently connect to the internet so that's not going to cause a problem.

I'll look into each of the things you have suggested and will see what I can do to help her.

Many thanks from me (and my sister)
I'll let you know how I get on

Lotty

busenbust

^This is a classic example of - and I know it's not what you wish to hear - backup and then backup :cool:

crampo_2

Theres a couple of programs. One thats all ready mentioned is Recuva.

Other Great Program is GetDataBack (NTFS & Fat , Based on File System)
You can use a free version to scan the system and view the files, but you have to register the program to save the files. Ive always used this program though and recovered every HDD ive come across.

busenbust

Peter: Hey Lois... what's this word? Lois: Evil. Peter: And this one? Lois: Knievel. Peter: And this one? Lois: Was. Peter: And this one? Lois: Born. Peter: And this one? Lois: In.
Peter: And this one? Lois: Montana. Peter: Ah... oh, hey Lois did you know Evil Knievel was born in Montana? Family Guy - I Take Thee, Quagmire 04x21

^:rotfl: Love all the episodes!

Chipping

To use Recuva without installing it, here is a method you can use:

1) get the portable version of Recuva (no installation needed - will need to unzip tho) from Piriform's download page. Copy it into a USB stick or USB hard disk.
2) get a large enough USB stick or USB hard disk that you can recover files to - if you find her photos, you'll need to copy them somewhere - you can't recover them to her laptop HD because it may overwrite other stuff. [Alternatively, if the laptop network connection is working you may be able to recover files to another PC (I can't remember if Recuva allows this) - but be careful that the files are not being copied to a local disk share, and remember, any actions you take such as setting up a new network connection can overwrite old data.]
3) get a bootable windows (WinXP) CD - there may have been one supplied with the laptop (be careful tho - recovery CD supplied with laptops may do nothing but re-install the op. sys.).
4) boot the problem laptop from the bootable CD (may take some time). You may also first have to enable booting from CD (by going into the BIOS/settings when you first power-up - before the op. sys. starts).
5) Once operating system is up, plug-in the USB stick and/or the USB HD, and run Recuva by double-clicking recuva.exe on the USB stick/HD. If you're lucky it will list a lot of files that can be recovered. Recover the files to the USB stick/HD.

The important thing to do is not to use the laptop hard disk for ANYTHING until after you've recovered all the files you can. This includes not starting up (booting) into the Windows that is installed on the laptop. You can start up in the Windows IF you really have to, and you can even make setting changes - but everything you do is likely to reduce the amount of files you can recover. The more you do the more is likely to be lost.

Thats why you need something else to boot-up with - a boot CD. You can try to boot-up using a USB stick but it is not straight-forward; you need to create a bootable USB stick (not as easy as a CD) and not all of them work this way and not all PCs allow this.

Ofcourse, if as someone already suggested, you remove the laptop HD and install it into another PC it would be an equally good method (with no need to worry about: which version of Recuva you use, having a boot CD/USB stick, where to copy files to).

Other more tricky methods:
a) download a bootable CD with recovery tools already on it from Internet. One such is Ultimate Boot CD For Windows (UBCD4WIN). This is probably not going to help you tho because its not just a straight forward download and burn. You actually have to build a burnable CD image from parts - its an involved & technical process (but when its done you get a bootable CD with the tools already on it).
b) download a bootable Linux operating system CD such as Super Rescue CD. The problem with this is you need to be familiar with Linux - it is not easy and straightforward. E.g. once booted you will have to specifically tell it to find, set-up and use the laptop's hard-disk.

Good luck :T

Backbiter

Before doing anything drastic, check how much hard disk space is being used. If quite a lot of it is taken up, then it suggests the missing files may still be there, hidden in some hidden folders. Something similar happened to me a while back when I did a system restore and it appeared to have wiped all my files. Lots of googling and patience led me to tarck everything down and I was able to put everything back in its proper place. It was something to do with 'taking ownership' of folders. Until I did that I couldn't find any files that I searched for by name.
This forum was a massive help:
http://en.kioskea.net/forum/affich-35141-lost-my-doc-media-files-after-system-restore.

The key was getting Windows to display hidden folders, as I knew my data had to be in one somewhere. To do this you change need to change your View Settings, as follows:

In Windows Explorer, click on Tools | Folder Options -> View Tab
Check the following:
Display the contents of system folders
Show hidden files and folders
Uncheck the following:
Hide extensions for known file types (WinXP)
Hide protected operating system files (Recommended)

You then need to search all the folders that are revealed, and hopefully you'll find your stuff, as I did.

Some people on that forum whose files went missing found them in C:/userdata, so you could search for that folder, but that's not where mine turned up.

After 'taking ownership' of other folders as follows:

"9.Right-click the folder name of the user account and click Properties . (This will be a folder that shows up when you are normally logged into windows, under my documents however windows shows it as empty and does not allow you at access it.)

10.Click Security .

11.Click Advanced . On the Owner tab,(third tab over) click the checkbox to select the Replace owner on subcontainers and objects option."

another search for *.doc showed my missing WORD files, and the name of the folder they were in. This mysteriously named folder contained 40Gb of data - everything which had disappeared during the System restore.

The search window revealed the location of this folder, and I was able to open it and move the files manually to where I wanted them.