A friends netvista/xp pro machine locked up on friday afternoon at 1500. They called and said there was a video issue, the keybd/mouse was not responding, and reboots were causing chkdsk to run. When I arrived the video image was half displayed on the screen (much like the horizontal hold on old tv's). I powered off the unit, rerouted the video cable so it wasn't stretching, and the machine came up with proper video but no response from the usb kybd/mouse. I was able to get a ps2 kybd from a neighbor and booted up with that. I went to control panel and the usb drivers were not installed, I did an update driver allowing windows to get the info automatically and the usb functionality returned. Here's the
problem- their programs and data are no where to be found. Kids pictures, financial info, business program gone. I've attempted to at least find a trace of them with active partition recovery but all logs and information are time stamped at 1500, nothing before that. It's as if the machine returned itself to a fresh install. Never seen anything like it, any ideas are greatly appreciated. Thanks in advance.

ps- I have the drive in my machine now as a slave and can access files if anyone can recommend where to look for at least a log of what happened.

this sounds like the scenario-

Consistency checking

"The second issue that arises is the disregard for data files. If chkdsk finds a data file to be out of place or unexplainable, it may delete the file without asking. This is done so that the operating system may run smoother, but the files deleted are often important user files which cannot be replaced. Similar issues arise when using system restore disks which restore the operating system by removing the previous installation."

It's as if chkdsk founds errors on the reboot and triggered the reinstall of the os from the cab files
on the hd. I don't see why the other programs were deleted though unless it took it upon itself to reformat the drive as well.

try gdb NTFS its a free tool that recovers all deleted files on the disk.it can take a lifetime to recover but believe me youll see files thats ancient on that disk
I dont know where to find it but try a google on it let me know how it went

Being a thinkcentre it had the the recovery partition on it. It's as if either chkdsk found errors on the reboot and triggered the reinstall of the os from the cab files in the recovery partition or the F11/access IBM key was pushed at boot and the option to recover included a full reformat of the hd. Still I would think I would find some trace of this occurring or prior disk structure in a history log.

i dont know of an app that can do that trick im sure there is.y dont you just spare yourself the delay if you like and do it the easy way instead

That's what backup files are for.