Lost/Deleted Files Major Help Needed Please!

[edsa131]

Good morning everyone

 

On Monday I was preparing the deputy head's PC for relocation to another office in school. Before I moved it I needed to add SIMS. While I was installing SIMS I checked out the PC and noticed that the hard drive only had around 800MB. I uninstalled some old software and ran disk check to get rid of the old windows updates etc. Then I ran Delprof.

 

I ran Delprof assuming that the DH was saving his work to the network the same as every other staff member. Happy with the work the PC was relocated and the DH moved into his new office.

 

Yesterday, the deputy head reported that he could not access his files. I checked his shared home folder and the share name did not match the home folder path in his AD account. There was a letter missing. I checked shadow copies and tried a restore from VEEAM and when looking at his home folder it was totally emtpy. He hasnt actually been saving his work to the network since he started work for us in September.

 

My guess is that his work has been somehow been saved to the local machine, but of course I ran Delprof so if it was going to any sort of local profile it would have been deleted.

 

I urgently need some advice on how I can recover this data. I didnt sleep a wink last night and have been sick this morning :-( Would the data have gone into a temporary folder somewhere on the hard drive? I took the PC home last night and ran a data recovery tool. The tool identified some files and some were unrecovereable. My plan this morning is to take the PC back into work and disconnect the hard drive and connect it to a SATA caddy and connect it to another PC and run the restore software from there to see if the results are different. Please can anyone help me here. Has anyone had experience of this issue?

 

Thanks in advance

 

Ed

[networkmangler]

Hi Ed

 

The first place I would check would be C:\Users

 

Another thing I would try would be to login as the DH and then open Word or Excel and then look at recent files. This should then give you a file location and at least somewhere to start looking

 

If your using roaming profiles you could also check the DH profile on the computer/server to see if any of the files have been saving to there

[witch]

@edsa131

 

I have changed the name of your thread so that people can see the issue and maybe jump in and help. I can't offer any more than has already been suggested but someone will be able to help you, I am sure

[CHiLL]

Once you ran DelProf, did you then install SIMS or any other applications, or copy other files to it?

 

Data recovery for something like this has been hit or miss for me. I'd mount the HDD to your machine using a SATA>USB caddy and use a program like Recuva to see what it can recover. I would prep the user for the worst and anything you get back is a bonus.

 

I did once use EaseUS but it's a paid application. It does have a free trial, but I can't remember what form the restrictions took, such as a 30-day free trial or recoverable data was limited to 1GB or something.

 

Regardless - take the HDD or the whle machine and provide a temporary one - you need to make sure they don't write more data to it because that'll permenantly overwrite 'deleted' data.

Edited January 22, 2020 by CHiLL

[Griff]

Few suggestions mostly using data recovery tools;

 

https://www.ccleaner.com/recuva - I have used this before to recovery a user profile and it worked really well. I cannot speak for the other tools below.

 

https://www.easeus.com/file-recovery/recover-deleted-user-profile-and-files-in-windows-10.html

 

https://www.ntfsundelete.com

 

https://www.hirensbootcd.org contains some recovery tools as well

Edited January 22, 2020 by Griff

[chazzy2501]

stop using the PC now! Remove the drive & stick it into another PC then use recovery software like recuva. https://www.ccleaner.com/recuva

 

good luck.

[PotNoodleTech]

Agree stop using it now as the more it is used the more chance of the old files being overwritten.

 

Recuva has done a good job on memory sticks for us before so I would try that.

 

When I am migrating a PC I am in the habit of double checkecking C:\user\username favourites, downloads and documents just incase.

[edsa131]

Thanks everyone, cannot believe this has happened. Over 20 years working in IT and first time ever. The DH is also pastoral lead so its extra crippling.

[witch]

It isn't your fault - it seems that the DH was never told where to save his files but that is just a small error on someone's part. Did the DH have induction? Who told the DH how to use the school network? If nobody did, lesson learned I would suggest.

Don't beat yourself up about it. Get that HDD out and do your best

[PotNoodleTech]

It isn't your fault - it seems that the DH was never told where to save his files but that is just a small error on someone's part. Did the DH have induction? Who told the DH how to use the school network? If nobody did, lesson learned I would suggest.

Don't beat yourself up about it. Get that HDD out and do your best

 

Also this can be addressed in active directory group policy - you can force all users to always save to their network drive so nothing ends up on the PC.

[chazzy2501]

This recently happened to me, a Windows 10 update stopped the "documents" library from re-directing to the %homedrive% This was for all teachers.

 

We hadn't spotted this issue until we upgraded a teachers laptop (win 8 to 10) and they couldn't find their files. A total loss.

 

I found that the "grant users exclusive use" in the re-direct GPO stopped it from re-directing. I un-checked it and had it move files to the new location but that one teacher was burned.

 

This issue must have happened weeks ago but no-one noticed.

[Davit2005]

When I first started in IT was told to re-install windows on a customers PC. So yes re-installed windows as requested, they missed out the bit about replacing the HDD first. GetDataBack for NTFS got us out of that one but had mixed success with it since.

 

In hindsight another way you prevent this is by having the Group Policy ADMX for MS Office (if that is what you use) and set the save locations to at least the users home drive for each of the MS products.

Edited January 22, 2020 by Davit2005

[edsa131]

Once again thanks for all your support. I cannot get to see the DH at the moment hes in meetings. I have the HDD attached to my PC and just ran RECUVA. It shows the deleted profiles and files associated with them including all office extensions, however when I filter down to documents it does not show any at alll for the DH. I am wondering if the files have gone somewhere else other than the usual place in the library.

[witch]

Stupid question - have you searched the server for any of his files? You just never know

[Griff]

Also stupid question and a long shot but is there any chance system restore/recovery was still turned on ?

[elsiegee40]

Also stupid question and a long shot but is there any chance system restore/recovery was still turned on ?

Previous Versions has dug me out of several holes

[Davit2005]

Previous Versions has dug me out of several holes

 

Users can be taught how to restore their own versions too. We deployed in a secondary school and users Staff/Students welcomed the ability.

[edsa131]

Thanks for all your support today everybody, much appreicated. I purchased EaseUS for £60 and managed to restore a high percentage of the data. I will also be implementing the server side suggestions you provided.

 

Peace!

[witch]

Thanks for all your support today everybody, much appreicated. I purchased EaseUS for £60 and managed to restore a high percentage of the data. I will also be implementing the server side suggestions you provided.

 

Peace!

 

That's good news. I've always found having the edugeeks at my back makes me much more able to think clearly