1. What is the best way to try to recover my files?
2. How do you think the files were lost in the first place?
3. What is the best way to get in touch with data recovery professionals to deal with my problem?
4. Is it safe to run chkdsk with the fix option right now?
5. Is it safe to run chkdsk with the "recover bad sectors" option right now?
6. How do you think my shadow copies were lost?
So here's what happened:
The computer had been on for a long time, running Avira antivirus and connected via ethernet to the internet and to a local business network with about 30 computers on it. (Avira never warned me about anything during all of the events described below.) Some time between 6pm on March 26 and 6am on March 27, I started running some commercial software called Nuance Omnipage, in order to take a number of pdf files in a single directory and save modified versions to a separate directory. A Windows update took place at 3am on March 27. I paused Omnipage at around 10am. Another user used the computer for about 6 hours starting around 10am, scanning documents with a Fujitsu fi-5900C scanner using TWAIN drivers and the Fujitsu ScandallPro program. I started using the computer around 8pm, and I did the following:
1. Ran some commercial software:
I unpaused Nuance Omnipage and began scanning some documents using a Fujitsu fi-5900C scanner using TWAIN drivers and the Fujitsu ScandallPro program. I placed a thick shipping envelope into the scanner and the scanner jammed. I received a message that the scanner had encountered some sort of error and the scan was aborted. I closed the scan program. I terminated the background process it had left running using the task manager. Then I started the scan program again, inserted the envelope again, and got the same message again. I closed the scan program. I stopped the current job in Omnipage using its graphical interface. I exited the program and Omnipage minimized to the tray. I terminated the Omnipage process using the task manager. downloaded
2. Reset the computer:
I reset the computer and found that all of the files and folders in my root directory were gone, with a few exceptions: the operating system files; the files in the Users folder; the programs and directories (but not the files in the directories) that were being used when the computer was reset, and the programs and directories that were being used by Omnipage and ScandallPro. My desktop and all of the files on it were just as they had been before, except that the shortcut to Microsoft Outlook had lost its icon. I don't remember whether I noticed that the files were gone before or after I restarted the computer.
3. Tried to find the files:
I verified that no files were being hidden, including protected operating system files. I checked how much free space was on the hard drive, and it was much more than there had been before. I right-clicked two of the directories I had been using and clicked "restore previous versions." I found that each of these two directories had several shadow copies. I created a new folder and tried to restore one of these two directories to the new folder. The directory I was restoring had probably been at least half the size of the entire hard drive. About 20% through the restore process, I received notifications that the restore process was unable to find any more of the files in the shadow copy. Then I right-clicked the same two directories again, and found that THERE WERE NO SHADOW COPIES AVAILABLE. I checked more folders, and no shadow copies were available for any of them. Finally, I checked Avira antivirus to see whether any files had been quarantined. They hadn't.
4. Made some mistakes:
I probably should have turned the computer off at this point, but since the shadow copies had been there and then had disappeared, I thought I might have been dealing with a virus and needed to save files as quickly as possible, and therefore couldn't wait to save files over the network. I downloaded Malwarebytes, restarted the computer in safe mode, and ran Malwarebytes. It found nothing. Then I restarted the computer again, downloaded Recuva, and ran it to look for deleted files from the directory I had tried to restore. This directory had a number of subdirectories. Recuva found a lot of deleted files but most of them were not listed as totally recoverable. I think every file not in a subdirectory was recoverable. I created a new folder and started recovering a bunch of files to that folder. I did some research on my phone and decided that it was too dangerous to save lots of files to the computer with the missing files. Then I stopped Recuva, started it again, and restored files over the network to a different computer. I downloaded Wondershare Data Recovery and scanned the same directory, and restored a few files over the network to a different computer. I restarted the computer several times and logged in as different users. The files were still gone. I started Recuva again and restored some more files (from the same directory) over the network to a different computer. Many of the files I restored were corrupt. The files I restored contained multiple versions of many files.
5. Made a disk check:
I right-clicked my root directory and performed a disk check. I did not check the box for fixing errors, and I did not check the box for scanning for bad sectors. It told me that some errors had been found and fixed, and that any files it found were in the Found directory. There is no Found directory on my hard drive. Here is what the disk check told me:
Volume label is Windows.
CHKDSK is verifying files (stage 1 of 3)...
145664 file records processed.
File verification completed.
481 large file records processed.
0 bad file records processed.
2 EA records processed.
14 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
179416 index entries processed.
Index verification completed.
CHKDSK is verifying security descriptors (stage 3 of 3)...
145664 file SDs/SIDs processed.
Security descriptor verification completed.
16742 data files processed.
CHKDSK is verifying the format...
36735592 USN bytes processed.
Usn Journal verification completed.
The Volume Bitmap is incorrect.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.
243933183 KB total disk space.
45760128 KB in 63659 files.
45964 KB 16743 indexes.
326987 KB in use by the file system.
65536 KB occupied by the log file.
197800104 KB available on disk.
4096 bytes in each allocation unit.
60983295 total allocation units on disk.
49450026 allocation units available on disk.
Note: At some point, I started getting the message that Windows Installer was starting whenever I either right-clicked my root directory or tried to run ScandallPro. I think it started in step 2 above, right before the last time I tried to scan the envelope. When this message appeared when I was trying to use ScandallPro, this message popped up repeatedly, and I clicked cancel in rapid succession about 10 times and then it stopped. When it appeared when I right-clicked my root directory, it went away after the first time I clicked cancel.
Edited by philippeiiauguste, 31 March 2013 - 07:36 AM.
Sign In
Create Account
