Lost Everything and have to hand in IT coursework tomorrow...HELP

asbokid

These are the basic rules to data recovery, guys..

i) stop using the machine immediately - the more you use it, the more likely it is that the operating system will write over the deleted data.

ii) boot from a separate operating system - whether that is booted from CD or from a USB flash media stick

iii) mount the hard drive on which the deleted data is held in read-only mode.

iv) undelete those lost files using whatever tool takes your fancy.. e.g. ntfsundelete

v) store those recovered files to a separate removable disc, e.g. a USB flash media stick

vi) only then do you try to repair the operating system or corrupted file system..

still.. it's not my homework, so............. ;-)

debitcardmayhem

The_Grandmaster wrote: »

Are you suggesting logging into the daughter's account in safe mode? I'm not quite sure if OP can log in or not (if that is possible?)
If OP can log on, what exactly do you think should be done - make a copy of the harddrive?

Once the file is located e-mailing it etc. would secure the documents away form the computer but not sure how to even find it at the moment.

Nope I was going to suggest using a linux cd/usb and just copy the daughters files to either a USB stick or the guest account or to the C:\ root partition. Unless the op has a huge external there is no point copying the whole drive.

timmmers

Did you try a simple system restore here ? Lots of assumptions here about malware, when maybe it's a drive problem (which can be caused by malware in rare examples).

Data is recoverable even when overwritten so it's really scarier than it looks right now...her solution lies in explaining and getting help from the guys who want the coursework really, given time and help all will be well if they allow her time.

t

debitcardmayhem

timmmers wrote: »

Did you try a simple system restore here ? Lots of assumptions here about malware, when maybe it's a drive problem (which can be caused by malware in rare examples).

Data is recoverable even when overwritten so it's really scarier than it looks right now...her solution lies in explaining and getting help from the guys who want the coursework really, given time and help all will be well if they allow her time.

t

Read post #1

The_Grandmaster

I guess go for it then... But give the OP good instructions on how to get and use the linux cd!

MrsTinks

If the IT techies at her school can't help - ie sound like they don't know what they're doing!!! - then take the laptop away with you and take it to someone who knows what they're doing - the data is probably still salvagable but messing about in the wrong way COULD loose you the data... if it's a hard drive error the data might still be there, but it also might not be... Personally if possible I'd say get someone to take the hard drive out of the laptop and hook it up to another machine as a slave drive and try to recover the data that way first... minimal intrusion and risk of loosing data.
For her next birthday might I recommend buying her an external hard drive? You can get them pretty cheap now or if she doesn't need that much space then a USB stick with a couple of gb of space should help prevent any future repeats.
I worked as a hardware engineer for HP and Compaq for several years and things do sometimes just break... if you don't have a back up as a private person you're stuck - companies pay tens of thousands just to recover a few gigs of data from the professional companies out there that specialize in data recovery...
If that seems remote as a likely scenario then remember laptops are easy to steal... a friend of mine was broken into last week and they stole a bit of cash and her laptop which she uses for her business... all her documentation etc was on it...

Hope you get the coursework back tomorrow!

asbokid

timmmers wrote: »

Data is recoverable even when overwritten

Whoah! Be careful with your claims..

In practice, that's just not true...

Once files have been overwritten in a Windows file system,they are gone for good..

Okay, if you are MI6 and have an annual budget of £20bn, and a ton of specialist equipment then, yes, you might get lucky and recover *some* overwritten data from Osama bin Someone's hard drive, but for joe bloggs with his home pc.. there's no chance..

One of the world's leading authorities on data recovery from magnetic media and solid state media is Professor Peter Gutmann...

Below is a link to Gutmann's seminal paper on the subject of data recovery....... It was published in 1996 and I doubt that there are many papers on the subject that have been published since which do not cite Gutmann.

http://www.softpres.org/cache/SecureDeletionOfDataFromMagneticAndSolidStateMemory.pdf

RussJK

timmmers wrote: »

Lots of assumptions here about malware...Data is recoverable even when overwritten

If it's not obvious to you or anyone else from her first post that it's rogueware hiding her files, then you really shouldn't be posting in this thread. The same goes for anyone else going on about recovery tools and the risks of overwriting the data, as all it's done is worry the OP to the point of inaction.

Her files are still there and won't be overwritten - because they were never deleted in the first place.

The rogue apps are after money, and unless these rogue apps have changed their MO then "missing files" means "hidden files".

debitcardmayhem

Its vista no other pc available oh and

stilltheone - hope the girlfriend got home safely , looks like your post got lost

RussJK

debitcardmayhem wrote: »

Hmmm just a question for now, but no-one has yet suggested either safe mode(or with networking) nor system restore let's first of all quickly discuss the merits of this bearing this is the only pc the op has use of. I would suggest that since the guest account is still working it may be of use to save a couple of rescue options to USB/CD not least that it may be possible to save the course work before trying other esoteric options ??

All these are definitely good options, particularly for rogue apps that also try to install backdoors or rootkits. It would be interesting to see what's waiting in the task scheduler to run on reboot...

She never tried the original suggestions of Malwarebytes and probably won't, so it's all a moot point really.