Recovering all disk as it was

Recuva
1

Hi,

I just tried out Recuva, very nice piece of software, I have to admit.

However I have a question regarding my case.

I had a doubtful pleasure to use mobile internet from well known european provider, which presented me with buggy software.

Trying to reinstall the modem and communication software I encountered a problem uninstalling the software.

I removed it manually, and after I start installation again it recognized somehow, that it's installed, and tried to uninstall non existant files.

After few minutes of hard disk activity, it deleted almost all files and folders from my drive C, all except locked ones.

I ended up with empty Program Files, Windows, and Documents and Settings folders, that couldn't be deleted since they contained a few locked files.

Recuva gave me the opportunity to copy my documents, so I did not loose precious data.

But the whole system is lost, many registered programs, mail accounts settings, passwords remembered by system, etc etc.

Since after the deletion I turned off the system, and it was never up again, the data is not overwriten.

Is there possibility to undelete files without copying them, just get them in the same place, like unchecking deletion ?

It would recover all system with all settings and documents.

I will appreciate any suggestions.

Regards

Pawel

2

You cannot undelete files in Windows, I'm not sure why but I suspect direct disk writes on a live file system would be rather unsafe.

Try System Restore, perhaps this could undo some of the damage caused by the uninstaller??

Richard S.

3

You cannot undelete files in Windows, I'm not sure why but I suspect direct disk writes on a live file system would be rather unsafe.

As I said, the system is not working, cannot be since it was deleted alltogether with my files.

I am recovering files from externally connected drive.

Regards

Pawel

4

Hi Powel, and welcome to the forum.

Sorry to hear of your problems, but some info may help. Which operating system are you using, and is it a desktop or a laptop computer?

Can you not boot your computer at all?

5

Hi Dennis,

The whole thing happened on my notebook, running Windows XP Service Pack.

After it happened I booted it from my repair CD, and I made a RAW sector by sector copy to an image, in case my recovery trials go wrong.

Then I removed the hard disk, and connected it to my second computer with USB interface.

In this configuration I have possibility to recover files with Recuva.

I made a full recovery of every file, but it's just a bunch of files laying on my second computer.

I could copy all files back to the deleted disk, but I am not sure if the system will start with them.

In old days, some system files were unmovable, and copying them was not a good idea.

Best thing would be just undelete file in their original clusters.

With FAT or FAT32 I was often recovering files manually restoring directory entries and their cluster chains in allocation table.

Unfortunately I stopped doing such things long before NTFS came in use, and I don't have time to learn NTFS details right now.

If general idea of Recuva is copying files by retrieving the data from cluster, that are marked deleted, and not undelete them, I would probably need some other tool.

Your opinion would be great help for me.

Regards

Pawel

6

Hi Pawel. This is just a question for thought. Wait for some of the members who really know what they're doing to comment.

Would a Linux distro, like Puppy, help Pawel? Or maybe a Linux boot disk? Some of the boot disks come with a partition manager that will reset the boot flag.

I mention it because twice I have used Linux to get a laptop working, but I hesitate to suggest it for someone else. I had nothing to lose.

Good luck. Would be interested to see what happens.

7

In the event of serious OS crash / disk corruption it is always better to re-install Windows rather than patch things up.

It maybe a pain to apply all the service packs updates and missing software but it's worth in known your files are error free.

Richard S.

8

In the event of serious OS crash / disk corruption it is always better to re-install Windows rather than patch things up.

It maybe a pain to apply all the service packs updates and missing software but it's worth in known your files are error free.

Richard S.

True, but this case is not a crash, there was no problem with the system.

The buggy uninstall procedure started from unexisting directory and deleted recursively all the content.

After that system was turned off immediately, and never started again.

This means, that after undeleting all files it should be fully operational.

Re-installing is always an option, but there are mail accounts with passwords, that are not always backed up.

There are applications that were registered using some unique system properties.

Some things are not easy to reinstall.

That's why I am looking the way to undelete files in their original places.

I have some software that is licenced with very peculiar ways.

To transfer it to another computer I have to invoke export procedure from working application to get transfer codes.

As a matter of fact I have already install fresh system on newly bought hard disk and notebook is already working.

But still many things are not recovered.

When I start the old disk I will be able to transfer licences and get all passwords.

Regards

Pawel

9

Hi Pawel.

If we are all reading you right, you have not only recovered all your personal data files to your external drive, but also your program files and folders and maybe even drivers and some system files.

Although that seems on the face of it to be a positive thing, it just wouldn't work the way you think it will.

You can replace personal data files (pictures etc) to their original folders, but you cannot restore files and folders from places like "Program Files", "Windows", Application Data" and similar Windows locations without creating possibly serious problems.

All these files rely on multiple and very often "common" entries in the Windows Registry to function correctly, and simply trying to restore them to their original locations would cause most of them to either load and then crash, not load anything at all, cause your computer to crash or "hang", and in the case of "drivers", would create fatal "BSOD" (Blue Screen Of Death) crashes.

As explained above, you will have to reinstall Windows either from Windows Disks or a Recovery Partition, catch up with all Windows Security Updates, and then correctly install all your programs again. Regarding commercial programs, the company you purchased them from should be able to help you out with re-installing and registration details.

Do you have Windows Disks or a write protected "Recovery Partition" on your hard drive, usually labelled "D".

One final thought Pawel. Are you sure that you've deleted all these files and folders, and haven't just screwed up the computers boot files, meaning Windows will not boot? It's unusual to have done something which would have deleted all that stuff.

10

Hi Dennis,

As far as I know Windows Registry is also stored in files, and restoring them alltogether with the rest of the system should work.

Problem is that I need to UNDELETE those files, not RECOVER (copied).

By "UNDELETE" I mean restore validity of the clusters that now are marked unused, and restore file information in file system.

I will of course try to run the disk with all files copied, and if files are not 'unmovable' this should also work.

I will let you know of the result.

Regards

Pawel

11

I wish you good luck with that Pawel, and I do see what you are trying to do.

I've been looking around at lots of "Undelete Files" utilities since you posted this, but they all seem to come back to the same thing, undeleting files by recovering them to another location.

None of them seem to do what the Recycle Bin does in simply "restoring" files to their original locations.

If only it was that simple.

12

I don't think that there's a cat in you-know-where's chance of undeleting files. NTFS updates certain fields in deleted MFT records to prevent them being accidentally accessed, and in files with many extents can overwrite the cluster addresses. Then there's the MFT bitmap, the cluster bitmap, the indexes, folders, other metafiles.. And that's just for one file.

The process would be impossibly complicated and you would be trying to 'undelete' something that may or may not physically exist, not a very good premise.

The recycler of course doesn't delete anything until you empty it, when the contents become un-undeletable.

Unfortunately Pawel, recovery is your only option. Whether that will give you a working, or partly working, system I don't know.