Forum Home
Press F1
 
Thread ID: 129508 2013-02-25 23:18:00 Gone! NZHawk (4093) Press F1
Post ID Timestamp Content User
1330008 2013-02-25 23:18:00 Windows 7 HP
friend observed that there was a lot of files in the recycle bin
pressed empty recycle bin
everything gone - all data & programs :waughh:
computer still boots fine
no restore point _ system restore was turned off
malwarebytes scan: clean

1] can the data be retrieved - yes has a back up
2] what happened? any idea's

did find to particular possibly related event errors:
Log Name: System
Source: volsnap
Date: 22/02/2013 7:12:57 p.m.
Event ID: 16
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Peter-PC
Description:
The shadow copies of volume I: were aborted because volume I:, which contains shadow copy storage for this shadow copy, was force dismounted.
Event Xml:
<Event xmlns="schemas.microsoft.com
<System>
<Provider Name="volsnap" />
<EventID Qualifiers="49158">16</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-02-22T06:12:57.345607300Z" />
<EventRecordID>174894</EventRecordID>
<Channel>System</Channel>
<Computer>Peter-PC</Computer>
<Security />
</System>
<EventData>
<Data>\Device\HarddiskVolumeShadowCopy2</Data>
<Data>I:</Data>
<Data>I:</Data>
<Binary>000000000300300000000000100006C0010000000000000000 000000000000000000000000000000</Binary>
</EventData>
</Event>


Log Name: System
Source: Disk
Date: 22/02/2013 6:42:23 p.m.
Event ID: 11
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Peter-PC
Description:
The driver detected a controller error on \Device\Harddisk7\DR8.
Event Xml:
<Event xmlns="schemas.microsoft.com
<System>
<Provider Name="Disk" />
<EventID Qualifiers="49156">11</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-02-22T05:42:23.010047200Z" />
<EventRecordID>174863</EventRecordID>
<Channel>System</Channel>
<Computer>Peter-PC</Computer>
<Security />
</System>
<EventData>
<Data>\Device\Harddisk7\DR8</Data>
<Binary>0E04800001000000000000000B0004C0030100000000000000 00000000082D000000000000000000C0EA000000000000FFFF FFFF060000005800000000000000FF0006120C000010000000 003C0000000000000000000000804D000480FAFFFF00000000 00000000109C970780FAFFFF00000000000000000000000000 00000000000000000000000000000000000000000000000000 000000000000000000000000000000000000</Binary>
</EventData>
</Event> 		NZHawk (4093)
1330009 2013-02-25 23:26:00 See if something like recuva can get them back. Just dont add or delete in the meantime. You'll have less chance of getting whatever back

This may or may not help with the first error (technet.microsoft.com) 		Speedy Gonzales (78)
1330010 2013-02-26 00:06:00 This is relating to the second error, which could also be the cause of the first:


Check something first :

Open the eventvwr, under windows logs/ System look for any clumps of errors saying Disk -- If there are several, or clumps of them the HDD is failing usually with bad sectors, if this is the case thats why the data and programs wont be showing, its there but a failed Sector(s) is masking it.

If theres only one or two scattered then something has corrupted the OS.

From second message
The driver detected a controller error on \Device\Harddisk7\DR8. as above, sometimes it means HDD failing.

Any chance its A Western Digital black Drive ? 		wainuitech (129)
1330011 2013-02-26 00:07:00 You sure they haven't just been logged into a temp user account?
Have a look in the Users folder and see if there are any other user profile folders there as that may be where the data is.

Edit: Just further to what wainuitech said, it looks like the hard drive could be the cause of the problem, and if the user profile files have become corrupted then Windows will log you in with a temp profile so no desktop icons, documents etc, just the default stuff. 		CYaBro (73)
1330012 2013-02-26 00:14:00 Thank you for the replies
I did look at users as this was a thought I had as well - there are only two admin & guest which is disabled
will check for hdd errors 		NZHawk (4093)
1330013 2013-02-26 00:36:00 wainuitech the log shows 4 errors in a row stating the same thing: "The driver detected a controller error on \Device\Harddisk7\DR8

does this confirm hdd faulting?

HDD: Western Digital Caviar Blue 		NZHawk (4093)
1330014 2013-02-26 01:51:00 Not Always - could be corrupted software.

How much Data needs to be recovered ?

HDD7 -- How many drives does this have ? 		wainuitech (129)
1330015 2013-02-26 02:11:00 Quite a bit - they used windows backup

1 hdd
1 dvd 		NZHawk (4093)
1330016 2013-02-26 02:40:00 I tried to test the hdd with Seagate & WD hdd diagnostics - both failed
WD: stated no hdd found
Seagate: just wouldnt go into the program 		NZHawk (4093)
1330017 2013-02-26 03:29:00 Try attaching a different HDD with an OS on it, see if theres any problems. This is to see if its the HDD ( of some sort) or the connections on the Motherboard. wainuitech (129)
1 2