Lost Everything and have to hand in IT coursework tomorrow...HELP

asbokid

MrsTine wrote: »

If the IT techies at her school can't help - ie sound like they don't know what they're doing!!!

I wouldn't expect the IT support staff in a high school to know what they are doing when it comes to data recovery.

- then take the laptop away with you and take it to someone who knows what they're doing - the data is probably still salvagable but messing about in the wrong way COULD loose you the data...

No offence to the OP's daughter and her GCSE coursework, but the money involved in calling in experts is not warranted by the value of the data...

if it's a hard drive error the data might still be there, but it also might not be...

From what the OP's daughter initially reported, it didn't sound like a hardware failure. It sounded like she had fallen victim to malicious code that has somehow corrupted the file system including the critical system binaries for the Windows operating system.

The crude text-based "hard drive error" that she noted, sounds like the error message that is thrown up by the BIOS to report that no valid master boot record (MBR) has been found. Insofar as recovering the data is concerned, that error message is no big problem.

Personally if possible I'd say get someone to take the hard drive out of the laptop and hook it up to another machine as a slave drive and try to recover the data that way first... minimal intrusion and risk of loosing data.

It's not really necessary to remove the drive from the laptop, and removing it is probably less safe than leaving the drive in situ. Also, removing and re-fitting in a desktop PC would possibly involve a specialist cable.

The secret to data recovery is not to write anything more to the disc. That way, you don't risk overwriting your prized data.

You make sure that you don't write anything to a disk-in-recovery, by mounting the disk in "Read Only" mode.

But that means you cannot and must not boot and must not run the operating system that is on the disk-in-recovery.

So what you must do is boot an operating system from a separate media to the disk containing the files that you want to recover..

That is why you should use a recovery CD or a bootable "live CD"

For her next birthday might I recommend buying her an external hard drive? You can get them pretty cheap now or if she doesn't need that much space then a USB stick with a couple of gb of space should help prevent any future repeats.

You can get free USB sticks from various outlets!

For absolute safety, I often email important documents to a webmail account, so that they are hosted offsite.

I worked as a hardware engineer for HP and Compaq for several years and things do sometimes just break... if you don't have a back up as a private person you're stuck - companies pay tens of thousands just to recover a few gigs of data from the professional companies out there that specialize in data recovery...
If that seems remote as a likely scenario then remember laptops are easy to steal... a friend of mine was broken into last week and they stole a bit of cash and her laptop which she uses for her business... all her documentation etc was on it... Hope you get the coursework back tomorrow!

Here! here!

stilltheone

Just back from walking my girlfriend home. So let's make some progress.

Shall we start with a Boot Disc, such as Kaspersky's Rescue disc? That will cover any fear of files being overwritten and begin the elimination of any existing malware.

If no malware is found we can check system file integrity.

Want agreement, so as not to confuse the poor OP.

RussJK

stilltheone wrote: »

Still unclear. Does it install the application or is it just a rules update?

Edit: probably incorrect

stilltheone

RussJK wrote: »

As I said, it installs Malwarebytes with up to date rules.

When you install from other mirrors, it installs Malwarebytes with out of date rules.

Have you tried this yourself? It just looks to me to install the Rules and not the GUI.

asbokid

stilltheone wrote: »

Just back from walking my girlfriend home. So let's make some progress.

Shall we start with a Boot Disc, such as Kaspersky's Rescue disc? That will cover any fear of files being overwritten and begin the elimination of any existing malware.

If no malware is found we can check system file integrity.

Want agreement, so as not to confuse the poor OP.

Hehe! Everyone's being very helpful. Is that the best rescue disk? Has there been a vote?!

addenda.. what tools will the OP need on the rescue disk?

Kaspersky Rescue disk doesn't seem to contain any file undelete utilities....

From: http://support.kaspersky.com/viruses/rescuedisk/all?qid=208282142

Kaspersky Rescue Disk 10 allows performing the following actions:

• Configure objects scan settings:
  • change security level
  • change actions to be performed on detected objects
  • create a scan scope
  • change types of objects to be scanned
  • limit scan time
  • configure scan of compound files
  • change a scan method
  • set default settings
• Configure databases update settings:
  • select an update source
  • specify proxy-server settings
  • specify regional settings
  • roll back to previous databases
• Configure additional settings:
  • select detection of specific threat types
  • create a trusted zone
  • configure notifications settings
  • specify time of storing reports
  • specify time of storing Quarantine and Backup objects

stilltheone

OP seems to have disappeared.

closed

http://www.bleepingcomputer.com/virus-removal/remove-hard-drive-diagnostic

asbokid

closed wrote: »

http://www.bleepingcomputer.com/virus-removal/remove-hard-drive-diagnostic

is that an educated guess for the problem that the OP is suffering?

closed

Could be various, russ has already posted a link which may be relevant, but only a few hide all the files, op has gone so who knows.

nearlyrich

She is probably trying to calm down a distraught DD not the best thing to happen on the eve of your GCSEs, I am surprised that they don't teach the value of backing up in GCSE IT these days! I hope you get the data back OP...