Strange Events in Win XP... All Documents Gone!?

Hey guys, my PC became unresponsive, and I held down the power button to power my laptop off. I then switched it on, and my laptop crashed again at the "Loading Personal Settings" screen. I powered off again, and this time Windows booted up into some strange mode, safe mode I think, and every single document is gone. All there is the programs. Every single document is gone. System Restore seems to be disabled for some reason, and Sophos Anti Virus didnt start up as usual. Now Im worried, and Sophos didnt show any viruses after opening it and scanning. I don't know what to do now, and I need my documents back

Any help would be much, much appreciated. Thanks.

 

I may be out of my league here. How about going into the bios and checking last known good configuration and try that?

 

How exactly do I do that?

 

Download a program that gets back deleted files (cause usually, they're not really deleted).

 

Dont install or move any files! Now try a Data recovery software!

 

I haven't moved any files, because I cant see any of them in My Documents, or on the desktop, where I left them.

I don't know if this means anyhting, but after Virus scanning, Sophos came up with this message about 5 times:

Also in the photo, the colour schemes of the MS Paint file bar are wrong, and the Windows is in a funny theme. Can anyone recommend good data recovery software?

 

The virus could have hit sophos specifically. That would put it out of commision. But yeah run a recovery program.

 

Exactly! its still on ur hdd, just that the usually deleting means its can be written over, so in u touch anything, come of the data will be written over!

 

uh

I had many files on my desktop, but I saved a picture file on to the desktop. Does anyone know of any good, free recovery programs.

Thanks so much for your help everyone.

 

Sounds like your registry is corrupted and you're actually logging in to the Administrator account in safe mode.
You need to follow the steps in the following MS knowledgebase article: KB307545 to recover your registry.

 

What is I mess up registry even more in the process of doing of? I don't have an XP disc, and my System Restore is disabled, so I don't think that would work. I would try that method once I've got all my documents recovered, if there is a way of doing so?

 

Do you have a desktop with working antivirus and extra sata/ide- and powercables? If yes, that's the best way of trying to recover the files, since you don't need to install anything on the laptop HDD.

 

Try the registry reanimator feature of Hiren's Boot CD: here

 

Note: in order to do the above, if the laptop in question is utilizing an ATA hard drive he would need a 3.5" to 2.5" ATA adapter, since laptop ATA hard drives do not have the same pinout as desktop form-factor drives.

 

There's no download link on that page?!

 

Oh, yeah. I have one of those, so I always forget others might not.

 

Sorry about that, try here
Note: that site redirects to rapidshare, so just click on "free" at the bottom of the page and then choose any server you like on the next page.

 

Your files are probably not gone. Windows probably created another user for you. Check in c:\Documents and Settings\<username> and see if your files are still in there. If they are, burn a CD of them (or copy them to a USB drive) right now. If they aren't, then you either have a really nasty virus, or your filesystem is hosed, and no matter what I'd suggest reloading Windows.

 

First of all, why don't you run a decent AV scan?

Download the free version of AVG here, and run it. If it doesn't work normally, reboot and run it in safe mode. Come back, and tell us if you can see your files again once the virus is gone. If not, you'll need recovery software.

 

Well I've got a corporate editon of Sophos, so I assume that would do.

Thank you so much Pita, yes I've got all my files now. It's most odd. All of the files are where you suggested there would be, but can I rectify this annoying problem without re formatting?

Thanks everyone

 

Still, get a better AV.

 

Specifically, where were the files ?

Sometimes, when a profile hive becomes corrupted Windows creates a different profile with a .000 extension...so

if you had a profile that was


c:\documents and settings\myprofile
there may also be a
c:\documents and settings\myprofile.000

The second one is the one you are logging into, and the first is where you old files were.

You can sometimes recover your registry hive as described above, but it is often a better idea to create an entirerly new profile (in control panel > users)

Move everything to that, and then wipe out the other two. That assumes only the user profile hive was damaged, and not more. The Antivirus error leads me to believe things are in worse shape and in that case, I would back up everything (data), then wipe out the drive and reinstall from scratch.

In the long run, you will be happier with this solution

 

I also got that error too, when I tried opening Steam.

And all my documents are in the standard place - C:\Documents and Settings\Mayur Lakshmi (my User Account name). However, the My Documents shortcut folder on the desktop is empty for some reason.

 

Best thing you can do: reformat. But you didn't have your restore cd, did you?

 

I don't have an XP disc either.... , and I dont want to use an illegal copy.

I just don't understand what the hell happend. It was fine yesterday, and I've got all my documents.

 

I see you created a couple of documents (iuntitled1 and untitled2) on your desktop

Go into MY COMPUTER > Local Disk C:....

Can you see them in :

C:\Documents and Settings\Mayur Lakshmi\Desktop?

If not, look in the other folders in

C:\Documents and Settings\{profile name}\desktop

where do they appear?

It will help to determine what went wrong.

 

No, those two documents (untitled, and untitled 2) are no where to be seen in the route directory.

Before this problem, my Desktop was like this:



Now, all those documents, on the desktop, are in the Route Directory: (C:\Documents and Settings\Mayur Lakshmi\Desktop)

 

You misunderstand me....I don't think they are there.

I want you to look in

C:\Documents and Settings\{profile name}\desktop

Replace {profile name} with the other folders you see

ALL USERS
DEFAULT USER
ADMINISTRATOR

or anything else. Where are UNTITLED1 and UNTITLED2 found?

Given your picture, you are clearly not using your old profile. I want to know what profile you are using.

This looks like a corrupt ntuser.dat file to me.

 

Sorry I'm confused, in Documents and Settings, there is a "All Users" folder, and a "Mayur Lakshmi" folder, and the All Users Folder is empty, and I cant find the Untitled images anywhere?!

 

START > MY COMPUTER, on the top choose TOOLS > FOLDER OPTIONS

Choose the VIEW tab and in the list below,
check
VIEW HIDDEN FILES AND FOLDERS
Uncheck
HIDE PROTECTED OPERATING SYSTEM FILES
HIDE EXTENSIONS OF KNOWN FILE TYPES

Now go back to
C:\Documents and Settings\

You should see several other folders there.

Check in DESKTOP within each profile you see for UNTITLED1....

 

Yes I have found the Image files, after doing what you suggested. There seems to be a another user, called "Temp", and, as you can see in the screenshot, there is an "ntuser" DAT file in All Users. I don't know if this means anything? And some settings have been chnaged. The UK english keyboard config has changed to the US config (@ and " are the wrong way round).

 

Anyone have any Ideas?

 

Yep,

That is what I expected--Windows cannot load your profile and is therefore loading a temp profile--usually, Windows alerts you to this, and usually this occurs when you have roaming profiles and the domain server is unavailable.

For it to happen with a local computer with a local profile is....odd.

Either your ntuser.dat inside c:\documents and settings\Mayur Lakshmi is damaged, or the registry entry pointing to it is.

If it's the former, we got problems, if it is the latter, we might have an easy fix.

OK, before we try anything else, let's run system restore

START > HELP AND SUPPORT, click
Undo changes to your computer with System Restore

Choose a restore point from before this occurance.

Reboot as directed.


Do you come up in your original profile?

 

System restore is disbaled

 

It may be disabled due to the temp profile thing....let's try and log in as an administrator

Restart your computer and tap the f8 key about once every second once your computer restarts (might see a spash screen or a memory count up).

You should see a text based advanced windows start up screen

Choose SAFE MODE.

When you get to a log in screen, choose ADMINISTRATOR

Try system restore again

 

I booted into Safe Mode, but System Restore is still disabled. I also tried the "Last Known Good Configuration" Boot option, but the same thing came, as in the screenshot above.

 

Had you turned if off at one time (to save space)?

Not liking this...let's test some basic functionality.

Go into Control Panel and Create a new user account--let's see if you can do that.

We may be chasing our own tail on this one, and we should probably go a different route.

After creating the new account, reboot...do you get a Windows Logon menu with the new user and the old user, or does it drop back into this default one.