How to Recover files lost after a SYSTEM RESTORE??

[ForceMajeur]

A friend with XP Home used the SYSTEM RESTORE function to restore a slow operating system. In the process the friend lost all her Outlook emails and her My Docs folder. What is the best way ( if there is a way) to recover those files lost when she performed the Restore function?

Thank you.

 

[RebateMonger]

Do you mean she:

a) Used a Dell "System Restore" CD (or the hard-drive-based System Restore partition) to completely erase her entire hard drive (including her documents and Outlook email) and to re-install XP Home and original applications back as they were "out of the box"?

or

b) She used the built-in "System Restore" function in XP to set her registry back to a prior version, keeping her document files and email intact?
Microsoft Support: How to restore the operating sytem to a previous state in Windows XP

It the answer is a), then if she doesn't have backups somewhere, it's going to be REALLY tough. She likely wrote over her documents and emails with the new install data.

 

[John]

http://www.runtime.org
http://www.r-studio.com
http://www.grc.com/sroverview.htm

 

[Slikkster]

Yeah, there's really no way to lose your documents and emails using XP's "System Restore". It's pretty clear it had to be the full OEM restore program. The way to recover from XP's System Restore is to undo the last restoration, an option clearly labeled.

 

[jameswhite1979]

could try = drive rescue

 

[John]

Originally posted by: Slikkster
Yeah, there's really no way to lose your documents and emails using XP's "System Restore". It's pretty clear it had to be the full OEM restore program. The way to recover from XP's System Restore is to undo the last restoration, an option clearly labeled.

Actually I have had several customers run the XP system restore to revert back to an earlier state and they've lost docs, emails, etc.

 

[RebateMonger]

Originally posted by: John
Actually I have had several customers run the XP system restore to revert back to an earlier state and they've lost docs, emails, etc.

Any idea why that happens? I thought that all System Restore does is change your Registry back to a previous version. You wouldn't THINK that'd cause emails or docs to go away. Weird.

 

[John]

Sounds like a M$ bug to me.

 

[kingtas]

That's news to me.

You sure that wasn't someone covering their a$$ for losing the data trying to fix it?

 

[erickj92]

Why does everyone have give people a hard time....?

There is small chance you can get it back... you will need to buy a hard drive, mabe 6-10GB in size and then get a restore program(which can be found all over the net) to recover with, and then recover the files to the new hard drive... i hope i made it clear..

 

[kingtas]

I don't think anyone in this thread was out of line. I have never heard of System Restore losing data. And of course if someones data, it might be easier to blame MS rather than own up to it. That's all.

 

[Slikkster]

Originally posted by: John
Actually I have had several customers run the XP system restore to revert back to an earlier state and they've lost docs, emails, etc.

Sorry...unless you can offer something other than that anecdotal statement, I don't buy it. If you can demonstrate to me exactly how this could happen, I'd be happy to stand corrected. But given that System Restore does not deal with a documents folder, how does one lose said documents?

(Now, if you're talking about reactivating a virus or trojan that has been cleaned from a system but still "living" in the system restore hives, that's another story. But that's hardly the fault of System Restore.)

I suppose it's possible (hardly likely, but possible) that someone never used their Outlook Express, for example, then decided to use it after older restore points had already been created. In this hypothetical, the restore might not recognize that the user had even setup OE for lack of the pertinent registry entries. But even then, the .dbx files would still exist, and could be imported back into OE.

It IS possible to lose files from one's desktop during a System Restore, particularly if they are any form of executable file. But even then, an UNDO will bring those back.

Read this interesting test of System Restore and how it applies to the desktop vs. saving files in My Documents, for example:

http://www.microsoft.com/windowsxp/usin...dsupport/expert/russel_sysrestore.mspx

You'll see that it is certainly possible to lose executable files residing on your desktop during a System Restore (and easily undoable), but NO document files.

And, as a companion test, you'll see that absolutely nothing in the My Documents folder--executable or otherwise--was disturbed during System Restore test.

 

[John]

Originally posted by: Slikkster

Originally posted by: John
Actually I have had several customers run the XP system restore to revert back to an earlier state and they've lost docs, emails, etc.

Sorry...unless you can offer something other than that anecdotal statement, I don't buy it. If you can demonstrate to me exactly how this could happen, I'd be happy to stand corrected. But given that System Restore does not deal with a documents folder, how does one lose said documents?

(Now, if you're talking about reactivating a virus or trojan that has been cleaned from a system but still "living" in the system restore hives, that's another story. But that's hardly the fault of System Restore.)

It IS possible to lose files from one's desktop during a System Restore, particularly if they are any form of executable file. But even then, an UNDO will bring those back.

Read this interesting test of System Restore and how it applies to the desktop vs. saving files in My Documents, for example:

http://www.microsoft.com/windowsxp/usin...dsupport/expert/russel_sysrestore.mspx

You'll see that it is certainly possible to lose executable files residing on your desktop during a System Restore (and easily undoable), but NO document files.

And, as a companion test, you'll see that absolutely nothing in the My Documents folder--executable or otherwise--was disturbed during System Restore.

Heh, I could care less if you "buy it" or not since these are my experiences as a tech. The customers that this has happened to have been customers of mine for years, and they know better than to lie to me. Simply because you haven't read of other stories doesn't make mine fictional.

 

[Slikkster]

Originally posted by: John
[Heh, I could care less if you "buy it" or not since these are my experiences as a tech. The customers that this has happened to have been customers of mine for years, and they know better than to lie to me. Simply because you haven't read of other stories doesn't make mine fictional.

I guess that pretty much says it all. Purely anecdotal, as I suspected, and replete with unnecessary attitude. No one said you're reciting fiction. But you made the statement that your customers have lost documents and data, and are merely taking their word for it.

Given that System Restore is set up to specifically avoid losing documents, I would think that given your years as a tech, you might be a smidge skeptical of the claim. No one said they were "lying". Like any non-expert pc user, they might be incorrectly assigning cause and effect.

Whatever...the end result is that I said I would be more than happy to stand corrected if you could point out exactly how this data loss might occur. Why? Not to prove you wrong. But so I would know in the future what to look out for.

 

[corkyg]

I suppose it could happen with the defaul email storage area used by Windows. But - that can be changed. I keep all my email in folders on an external drive - System Restore does not mess with it. Basically it changes the Registry and some file associations and links for drives designated for such protection. External data drives don't get bothered by that.

You should be able to recover the .dbx and text files by checking the OE Store Folder. Where is it? Tools, Maintenance, Store Folder. And that is what is so easy to change.

 

[John]

Originally posted by: Slikkster
I guess that pretty much says it all. Purely anecdotal, as I suspected, and replete with unnecessary attitude. No one said you're reciting fiction. But you made the statement that your customers have lost documents and data, and are merely taking their word for it.

Given that System Restore is set up to specifically avoid losing documents, I would think that given your years as a tech, you might be a smidge skeptical of the claim. No one said they were "lying". Like any non-expert pc user, they might be incorrectly assigning cause and effect.

Whatever...the end result is that I said I would be more than happy to stand corrected if you could point out exactly how this data loss might occur. Why? Not to prove you wrong. But so I would know in the future what to look out for.

Your first sentence in the previous reply shows doubt and disbelief. It's no different than saying it's bvllshit, now is it? I am also wondering how my rebuttal is anymore obtuse than your "I don't buy it" statement. :roll:

All I know is that these particular customers do not know each other, but they experienced some data loss after restoring to an earlier checkpoint. I have no idea how it happened, and I haven't take the time to figure it out either. You're acting like a particular feature of an OS isn't prone to glitches. How do you explain the loss of a partition table when there hasn't been a power outage, the system is 100% stable, and all hardware passes diags? Is it really a HDD problem or is the OS at fault? Staying on topic....it's time for data recovery.

 

[Slikkster]

Originally posted by: John
Your first sentence in the previous reply shows doubt and disbelief. It's no different than saying it's bvllshit, now is it? I am also wondering how my rebuttal is anymore obtuse than your "I don't buy it" statement. :roll:

All I know is that these particular customers do not know each other, but they experienced some data loss after restoring to an earlier checkpoint. I have no idea how it happened, and I haven't take the time to figure it out either. You're acting like a particular feature of an OS isn't prone to glitches. How do you explain the loss of a partition table when there hasn't been a power outage, the system is 100% stable, and all hardware passes diags? Is it really a HDD problem or is the OS at fault?

You're right, it does show my doubt and disbelief; absolutely. That's why I asked for more clarification. You know, people come to these forums looking for help and, hopefully, for some accurate information. I know the second part is problematic, of course. But here's why I particularly made note of your remarks: Perception does matter. Someone looks at your posts and sees that you have an "Elite" status and over 30,000 contributions to the forum. That carries some heft to it. And the status is obviously well deserved. I've read (and learned) much from your previous posts on tech matters.

In this instance, you essentially challenged my statement about System Restore (nothing personal), and threw out this comment about people losing data using it. Now what is a casual user going to (possibly) take from that? They may very well take "Gee, this guy's an expert. He's an "Elite" forum member, and he says people have lost data using System Restore. I better stay away from that!" Can't you see that? You then went on to posit that it might be some kind of Microsoft "bug", again reinforcing the potential dangers of using System Restore.

I just think, and it's my opinion only, of course, that you should be aware of how your status here might affect people's perceptions of your posts. An anecdotal statement that you really can't even verify can easily be misinterpreted as "fact".

Additionally, if it IS a potential danger (document-wise), I most certainly want to be aware of it. But there hasn't been anything offered to demonstrate that. And if it truly was a real problem with SR, Microsoft would have had a total calamity on their hands by now with complaints of lost data.

That's where I'm coming from, and that's where I'll leave this thread, with apologies for going OT. As Bill O'Reilly would say, "I'll give you the last word".

 

[tommytran]

Provided that the sectors on the hard drive haven't overwritten, you can try some of the utility from here http://www.pcworld.com/downloads/collec...id,1295-order,1-c,downloads/files.html

 

[John]

Originally posted by: Slikkster
In this instance, you essentially challenged my statement about System Restore (nothing personal), and threw out this comment about people losing data using it. Now what is a casual user going to (possibly) take from that? They may very well take "Gee, this guy's an expert. He's an "Elite" forum member, and he says people have lost data using System Restore. I better stay away from that!" Can't you see that? You then went on to posit that it might be some kind of Microsoft "bug", again reinforcing the potential dangers of using System Restore.

So if I would have said that I personally ran the system restore on a couple of pc's, with this particular version of XP, specific data was lost, and data recovery was necessary, it would have held more ground in your eyes, and the eyes of other casual users? Until someone lies to me I have no reason to doubt their word; maybe you should take the same approach.

 

[Slikkster]

Originally posted by: John
So if I would have said that I personally ran the system restore on a couple of pc's, with this particular version of XP, specific data was lost, and data recovery was necessary, it would have held more ground in your eyes, and the eyes of other casual users? Until someone lies to me I have no reason to doubt their word; maybe you should take the same approach.

Absolutely it would have made more of an impact on me if you, personally, experienced it. Why? Because you have the expertise, and you could provide the context, and the specifics about what happened. Come on, man. That's obvious. Let's not even go there.

If my mom, who I would consider a pc support "customer", given the amount of help I've had to provide her, told me "I did A: and then B: happened", would I accept that as the absolute cause and effect of her pc problem? No way! I have far too much experience with her computer issues to know that her perception of what she did and the outcome thereof might not be limited to what she remembers she did. In other words, she might have done several other things that contributed to her issues, but in her mind assigned the cause and effect to A: and B:.

Does that mean my mom's lying to me? Of course not. That's what she thinks happened. And only from my troubleshooting and digging into the problem do I eventually uncover the REAL cause of the issue. This is what I'm saying.

It has nothing to do with "believing" people. It has everything to do with having expertise and experience, which frequently means in the pc support world that you use a customer's statements of what happened as a jumping off point, not as gospel. Hey, some people know they've done something wrong and are too embarrassed to admit it, hoping you (the expert) can remedy it. That's human nature.

Anyway, enough of this. There's really nothing more to say. I only replied here because you asked me a question. I'm out.

 

[RebateMonger]

Personally, I'm willing to believe that just about ANYTHING can happen in the world of PCs.

If either Slikkster or John tell me that they, or a trusted person, experienced something "weird", I'd take note of their comment and be on the lookout for that problem. Some VERY WEIRD stuff happens sometimes.....

Originally posted by: Slikkster

Read this interesting test of System Restore and how it applies to the desktop vs. saving files in My Documents, for example:
http://www.microsoft.com/windowsxp/usin...dsupport/expert/russel_sysrestore.mspx

Nice link. I didn't know that a System Restore will throw away files on the desktop. Probably just as well. LOL

 

[kingtas]

Wow, that's nice to know. Thanks for the link Slikkster.

I know people who use their desktop as the my documents folder.

 

[Rottie]

While reading this I realized it is time for me to back up my Outlook Express today Anyway I don't put all documents in the default my documents folder I put my documents folder in other hard drive whenever the C: drive fails I still have all documents intact in D: drive.

Anyway I never use System Restore I don't think it works for me I turned it off after Acronic True Image backup everything.

So always remember to back up.

 

[John]

I serviced a new customer's pc last week and set a couple of restore points. Today she calls and says "my brother ran the XP system restore since he couldn't access the internet", and then asked if I could fix her back up since she lost her recent quicken data + my documents.

A quick peek in the c:\ showed the quicken data backups folder I created last week, in addition to some of the other tools that I used to clean malware from her pc. It was obvious that a "system recovery" was not done (she wasn't 100% sure) and that it was truly an XP system restore. Fortunately I restored her files from a pendrive that I sold her when she picked up the pc last time. This time I suggested a limited account for her brother. I also hit her with another labor charge.

So here is yet another instance of the system restore zapping "my documents". Is it supposed to happen? No. Can it happen? Yes.

 

[Slikkster]

Ugh, not this again!

What's amazing to me is that you seem to have an inordinate number of clients who experience System Restore problems, lol. I've tried to find instances of people losing files/data/My Documents, etc. via web searches, and I'm coming up empty.

I haven't been able to find any references to people losing Quicken data from using System Restore.

I posted a link earlier in this thread that specifically warns that System Restore CAN delete files that are saved on the Desktop.

Here is the official list of "monitored" file types by System Restore. If any application shares these extensions, it's quite possible that SR would remove them:

http://msdn2.microsoft.com/en-us/library/aa378870.aspx

I don't see the Quicken file extensions in that list (from the Quicken files list that I've seen.)

Now, to your customer's situation:

Again, you're using this as some kind of concrete proof of a System Restore issue. In fact, the proof you're offering is far too weak to come to that conclusion.

1. The customer wasn't even sure what kind of "restore" her son did.

2. Who knows what he did? He could have done any number of things to the pc that might have caused problems. You were wise to suggest a limited account for him.

4. Are you saying the "couple" of restore points you added were the only ones on SR to utilize? How do you know --particularly since you don't know for a fact what he did-- which restore point (if he even used SR) he chose?

3. Since you did not mention that you tried to UNDO the restore, I will safely assume you didn't. That would have been the easiest test to do, as it would have restored any changes --files included-- from any previous restore.

4. Additionally, when running System Restore again, it would have prompted you right away to UNDO your past restore (if done). That would have been your "proof" of an SR issue; the smoking gun, so to speak. But I don't smell any smoke here. It's apparent you didn't do that, but rather chose to restore from external backups.

5. Here's something that's equally as plausible (if not far more so) about HP and Compaq System Recoveries. HP and Compaq are used as an example here to show that it's quite possible to do a System Recovery and still have left other folders created by the user AND while still losing files in My Documents --exactly the situation you are describing:

From HP: http://h10025.www1.hp.com/ewfrf/wc/genericDocument?cc=us&docname=bph07145&lc=en

"CAUTION: Performing a Destructive Recovery will format the hard drive. This will delete all the information on the hard drive and reinstall Windows XP and the original software that came with the computer.

Performing a System Recovery (as opposed to a "Destructive Recovery") replaces system files and original software with the files that originally came with the computer.

This process (System Recovery) may move or remove certain files, like those stored in My Documents. Before performing a System Recovery backup important files and the files stored in the My Documents folder."


As you can see, the System Recovery option would most certainly leave any folders created by the user (or you), and at the same time wreak havoc on the My Documents folder. So again, this is, at the very least, a likely explanation of what happened to your customer given what is known about XP's SR and this particular System Recovery process.