Full Profile Reset

[garethEds]

I have come into work this morning a user is reporting that files have gone missing from his desktop. It seems his user profile has completely reset. It has lost email settings and links to favourites.

It has also lost the mapped/linked drives.

 

I have checked the C drive and the profile is there - but it's a brand new one that has over written the old one.

 

Now - I tell them not to save on the desktop - but this is not the issue right now (they will be told again).

 

I've run file recovery software - doesn't find anything. None of the missing files are there.

 

Has anyone seen this issue before?

 

Cheers

 

Gareth

[Norphy]

There is a group policy setting which removes profiles that haven't been used in X days - you've not got that set have you?

[fredesq]

There is a group policy setting which removes profiles that haven't been used in X days - you've not got that set have you?

 

This, when it clashes with certain windows updates, will wipe the profiles regardless of when they last logged in in some cases.

[garethEds]

There is a group policy setting which removes profiles that haven't been used in X days - you've not got that set have you?

 

Maybe that is the case - but surely the files would still be on the hard drive? Thinking of it - the computer was used last Thursday and this happened on Friday.

 

Gareth

[garethEds]

This, when it clashes with certain windows updates, will wipe the profiles regardless of when they last logged in in some cases.

 

This is annoying - not found any reference to this when searching Google. However - surely the files will be on the hard drive somewhere? No recovery software can find them in the Desktop folder (or when searching the whole C drive).

 

I'm using Recuva for the scans. Any other free ones?

 

Gareth

[fredesq]

Photorec i've had good success with.

[Primus]

Profiles can be very delicate things - I've seen them wiped out just by monthly updates, this is why we redirect folders either to a file server or to OneDrive.

[Oaktech]

I tell people not to get too atached to their profiles, they aren't forever. We redirect everything important, including desktops, and we encourage password sync to any browser password manager, that way if a profile goes bye-bye the worst that happens is having to reset default apps and the outlook profile

[garethEds]

Thanks everyone. I get the profile ways - but those files must surely be on the hard drive/SSD. Why are no disc recovery apps picking them up?

 

Gareth

[Duke5A]

Thanks everyone. I get the profile ways - but those files must surely be on the hard drive/SSD. Why are no disc recovery apps picking them up?

 

Gareth

 

I hate to be the bearer of bad news, but it's already gone. If the drive is in fact an SSD then TRIM already zeroed the space the profile used to sit on. I can't speak as to why their profile got nuked. Maybe something Event Viewer could tell you.

[garethEds]

Photorec i've had good success with.

 

For photos or for everything?

 

G

[howartp]

For photos or for everything?

 

G

 

I use TestDisk which is in bed with PhotoRec.

 

Bare metal or otherwise.

[Davit2005]

This is annoying - not found any reference to this when searching Google. However - surely the files will be on the hard drive somewhere? No recovery software can find them in the Desktop folder (or when searching the whole C drive).

 

I'm using Recuva for the scans. Any other free ones?

 

Gareth

 

Many years back I had great success with getdataback ntfs. I say great success as my first IT role I got told to re-install an OS on a customers PC but they'd forgot to tell me to use a new hard drive, lol.

[Foresthippy]

If you look in the c:\users folder, there isn't a duplicate with the domain name appended on the end? Or if the user has previously been renamed (i.e. after marriage surname change) the profile could be there under their previous name as even though their username has changed, local profiles don't get renamed.

 

Edit: also, depending how you have permissions set on local profiles, searching c:\users might not find anything as admin won't have access to files. I would check the list of profiles carefully (individually) in case it's all still there somewhere.

Edited November 3, 2021 by jdmackay