Possible to restore the deleted system files after executing the command ?rd /s C:\? (max. 15sec.)?

Recuva
1

Hello,

My OS is Vista x32. I have execute in CMD the following command ?rd /s C:\ $recycle.bin?, to resolute a small problem with the recycle bin. But the syntax was from a forum wrong. The right syntax that I have to execute is ?rd /s C:\$recycle.bin? (without spaces between C:\ and $recycle.bin). Al I sat in CMD it started to delete other system files, I have recognized the problematic situation and have reset the PC. After running the command the process took about 10 second! Not all files and directories were deleted. I can?t boot, but I have access to this corrupted SSD on another PC also with Vista OS. Repair install with Vista DVD is not possible.

Can I restore the delete system files on C:\ drive, that was deleted with the command (?rd /s C:\ $recycle.bin? is the same like ?rd /s C:\??

(the capacity of the SSD is 128GB and the system partition is only 60GB with free place from over 9GB. The rest /the other allocation place of the SSD (the other second partition) is over 63GB with over 37GB free place, so I think that the deleted files have not been overwritten).

1. Is there a way to sort the data by name, then just pick them up and restore?

2. There are many files listed with the path "C:\?\". Where to put it? Are these files important or can I ignore it?

3. Can Recuva restore system files to, or only user files?

4. Does anyone know what system files were absolutely essential for the recovery and what I need to pay special attention (there are a total of over 164,000 non-overwritten files listed and the rest are about 52,000 overwritten files)?

Thanks in advance

2

What a terrible thing to have happened to you :(

What operating system are you using?

Do you by any chance have a system image?

Are all the files in C drive deleted?

Can you still boot?

Have you read the docs here which might help a bit.

http://www.piriform.com/docs/recuva/using-recuva

Doing a repair install with Windows disc may help if all else fails. You may lose some personal stuff (hopefully you may have them backed up)

3

Hello hazelnut,

sorry, I have my post (above) has just completed.

What operating system are you using?

Are all the files in C drive deleted?

Can you still boot?

Doing a repair install with Windows disc may help if all else fails. You may lose some personal stuff (hopefully you may have them backed up)

- Vista x32

- Maybe about 65% of the files are not deleted.

- I can?t boot, but I have access to this corrupted SSD on another PC - also with Vista OS.

- Repair install with Vista DVD is not possible to.

Have you read the docs here which might help a bit.

http://www.piriform.com/docs/recuva/using-recuva

yes, I have read it - all.

4

After reading this about Vista I am a bit concerned in case you cannot get everything recovered.

If you delete components from the WinSxS folder like the manifests or the assemblies, etc, you could be in trouble. Each system would react differently. What may work for one could break another! For instance, if you install a program that requires that particular assembly, which you may have deleted, then that program will just not run

http://www.winvistaclub.com/f16.html

Did you have any system restore points?

Can you borrow a Vista disk?

Are your documents still available to you? If so, can you copy them to a safe place using a Linux liveCD?

I am hoping some other members may have some other ideas for you.

5

I am assuming that the folder WinSxS is not affected. If yes, then max. 3% had deleted it. In search in Recuva of "WinSxS" it shows me that there are many undeleted and not described files available (marked with green and with green-white point).

Should I try to restore only those folders/files from the SSD, that are marked with green dot? I'm assuming that other files (with green-withe dot) are the one, that was not erased and remains on the disk and are normally present in their folders. Right?

Many files that are marked with green dot, have in their name a $$ (but not all files with green dot are with this $$ renamed!).

>Did you have any system restore points?

Yes, from every day min. 1x!

>Can you borrow a Vista disk?

I have a Vista Disk. But a system restore at the moment is not more possible, withouts missing system files. I think this process is currently very dangerous, because unnecessary write operations on SSD, which leads to override the cluster (on a SSD it is normally a small problem, because the firmware is intelligent and ensures that the memory cells are sequentially overwritten).

I want first to restore the system and important system files from programs. Only then I will try again to repair the system with a Vista disk and a restore point. It is OK and right?

>Are your documents still available to you?

All my files are in a safe place (on another partition) and are not affected.

But many other important personal files that are stored by the program as a system files on the SSD, with whom I work every day, must be restored unconditionally (Oulook, CAD, online banking and other important). I know this personal system files (for security reasons) never work again in another system (with a different OS-ID).

I have to restore the system. Then to start each program an with export backup functionality to export all data and then it would be possible to transferred this to a different system. I would be willing to reinstall the system or change to Windows 7, but only when I have running my programs successfully. These programs can I repair with repair-function or re-install to restore each missing or damaged files. But the user files can not miss, otherwise I get a serious problem.

Can Recuva restore files from an SSD?

6

I'm surprised that Windows would let you delete any system files, unless the device was mounted as a non-system drive. There are, I believe, only about 16 system files that Windows needs to function, the files starting with $. However there are probably hundreds of drivers, etc that you have installed to customise your system. Even if you recovered these files I don't think that you have much, if any, chance of restoring a working system. There are just too many variables to take into account.

I guess you have TRIM enabled, in which case the deleted files are being mopped up as we speak. If you have then look up Garbage Collection in Wikipedia. Files which have been 'collected' are lost forever.

Where does Secure Overwriting come in? Although you can't physically overwrite anything on an SSD Recuva's secure overwrite will write a new version of the file in a new block, unless GC has nabbed it.

SSD's are a very different kettle of fish from a hard drive. I don'tr really know what to advise after system file have been deleted, apart from a reinstall.

7

they are a lot oft files listed, that have the same directory like this here:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Dateiname: $$03B7~1.CDF

Pfad: C:\?\Windows\winsxs\FileMaps

Dateiname: $$09A9~1.CDF

Pfad: C:\Windows\winsxs\FileMaps

Dateiname: $$DeleteMe.msxml6r.dll.01cc43f9dcedb790.0007

Pfad: C:\Windows\winsxs\Temp\PendingDeletes

Dateiname: 0010cd52324dcc01bc0b000074076009.$$_microsoft.net_framework_83386eac0379231b.cdf-ms

Pfad: C:\Windows\winsxs\Temp\PendingRenames

Dateiname: 0243751a3db077658593b92ee56beffeeb40d16ad0d6874e45c92e22f9e4baf7.cat

Pfad: C:\?\Windows\winsxs\Catalogs

Dateiname: 029c6e8c44a87987.dat

Pfad: C:\System Volume Information\SystemRestore\FRStaging\Windows\winsxs\x86_microsoft-windows-t..languages.resources_31bf3856ad364e35_6.0.6000.16386_ro-ro_f75f152a4e5cbade\chatsync\02

Dateiname: 0D0458~1.DLL

Pfad: C:\Windows\winsxs\msil_msbuild.resources_b03f5f7f11d50a3a_6.0.6000.16386_de-de_2ac06905a5519bf9

Dateiname: D41095~1

Pfad: C:\Windows\winsxs\Manifests

Dateiname: x86_microsoft-windows-help-wnewue_31bf3856ad364e35_6.0.6000.16386_none_e1a3ef941b76c6cf.manifest

Pfad: C:\Windows\winsxs\Manifests

Dateiname: x86_microsoft-windows-i..ional-codepage-1250_31bf3856ad364e35_6.0.6000.16386_none_1f01fea00df2e944_c_1250.nls_71105a0f

Pfad: C:\Windows\winsxs\Backup

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Which directories under WinSxS the files must be restored necessarily? And which directories could possibly be ignored?

I've just discovered a fundamental flaw in the program Recuva: the values ​​for "Creation Date" and "Last used" are displayed reversed on the "Info"-tab. Recuva is actually v.1.40.525 and is in GERMAN. Probably only the translation in Germany is wrong (I have not tested the English version).

8

Hello Augeas,

I'm surprised that Windows would let you delete any system files, unless the device was mounted as a non-system drive

I'm surprised to. (Of course was the SSD on the moment a system drive - I don't have normally time for any experiments. I have written above that after PC restart, the strange error message had appeared about an error with the recycle bin. And as I've found on forums the solution to the problem, I've used this same, but the syntax for the command is misspelled on this forum - with a silly spaces between.)

I don't use TRIM or any similar tools with the same intentional. Vista defragmented tool was of for this SSD from the beginning.

SSD's are a very different kettle...

I know about it - and every SSD user probably to.

I can restore with Recuva allegedly about 150.000 files, which are represented as Excellent. The problem is: which files exactly should be restored?

All files, which I have analyzed from winsxs in Recuva, are already normally present and available on the SSD as not deleted files. I compared many files from the same directory together and it's actually the same files: "Creation Date", "Last used" and the "size" values are the same.

My folder winsxs was three months ago about 11,5GB and now about 10,2GB. But i have uninstall SP2 and PS1 four weeks ago.

I need your help: can it really be that Recuva not get along with SSD and lists many files to the rescue as "Exzellentz", but they exist on the SSD furthermore as normal and appear as normal (those that were never deleted)?

9

Is it possible in Recuva to sort by a directory, but to include only files that have a status of "Excellent" and all remaining non-recoverable files to switch off (not display them)? And how should this be done?

Respectively, if you are in the opinion the project with Recuva would be very difficult to achieve, then what alternative software I want access to restore the important system files successfully?

Thanks

10

Recuva will recover files from an SSD the same as from a HD. The developers are aware that the Creation Date and Last Used are swapped.

I would treat all files as capable of being recovered, and ignore the state. You need to try to get as many files back as possible.

You can sort Recuva's results by column, and/or filter in the File/Path box, but you can only sort by one column at a time.

It's impossible for any of us to say which of your 200,000 files should be recovered, although someone with Vista experience may be able to have a guess. It is a horrendous task to attempt to rebuild the SSD like this. Presumably to get the partition back to a bootable state you will be recovering to the same partition, which is not the best practice.

Run Recuva (open a new run if necessary) and run a normal scan with Scan for non-deleted files checked in Options. Do you have at the start of the list about 10+ files beginning with $? Then you will need just about everything in c:\Windows except the $uninstall stuff. All you can do is try this and hope. Recover any user files off the SSD c partition to another drive to reduce the chance of overwriting data.

11

There are no files listed in Recuva in C:\Windows beginning with $. However in directory C:\Windows\winsxs there are many files listed beginning with $ (but also many files in the same directory with $ somewhere in between the names).

There are not .pst-file to find to (Outlook file) and on the SSD there are almost all files from the C:\USER folder away, except only 16 files and 29 folder.

The option "Deep Scann" show much more files (over 690.000), but for E-Mails files it gives the same result.

And now?

For any help I would be very grateful.

12

I think that you should consider getting professional help for your disk. I can't really see how we can get the disk back to a bootable state. You need someone with the right skills to see the disk.

13

I think that you should consider getting professional help for your disk. I can't really see how we can get the disk back to a bootable state. You need someone with the right skills to see the disk.

I would agree with Augeas here.

The fact that you are going to have to recover so many essential files means many things could go wrong.

Please let us know how things go.