Member Avatar for mundee

My Windows 2000 computer detected a severe virus and I was afraid that my entire computer would crash so I panicked and stupidly deleted the entire administrative user account without thinking about my files nor backing them up. I was more concerned with my installed expensive software being affected. Now that I successfully removed the virus on my other user account and am able to use all my software. I am trying to recover my lost files now. I am not sure what to do. Please advise.

  • 4 Contributors
  • 5 Replies
  • 211 Views
  • 6 Days Discussion Span
  • Latest Post Latest Post by jaydeee

Dani AI

Generated

Short summary and immediate do-not-do list tied to the replies above ( , , , ):

Stop using that drive. Any further writes (installing software, letting Windows create new files) reduces the chance of recovery. Do not run chkdsk, do not reinstall Windows to that disk, and do not save recovered files back to the same disk. The ideas already suggested — trying an undelete tool and attaching the disk to another machine — are valid, but use a safer workflow below.

Recommended workflow (safe, sequential)

  1. Power down and remove the drive or prevent writes (boot the recovery machine from a different disk).
  2. Make a full, sector-by-sector image of the problem drive and work from the image. Imaging preserves the drive state and lets you retry without further risk. On Linux a common command is:
    dd if=/dev/sdX of=/mnt/recovery/image.dd bs=4M conv=noerror,sync

    For failing drives, use ddrescue with a log file so bad sectors can be retried:

    ddrescue -n /dev/sdX /mnt/recovery/image.img /mnt/recovery/image.log
  3. Run recovery only against the image. Use an MFT-aware tool first (to recover filenames and folder structure), then a file-carving tool if needed. If that fails, try a mix of tools (TestDisk to repair/restore metadata; PhotoRec for carving; commercial packages if a GUI is preferred).

Practical tips and caveats

  • Always copy recovered files to a different disk.
  • Look for the profile path C:\Documents and Settings\<username> and NTUSER.DAT when searching for user data and settings. NTUSER.DAT can be inspected or loaded as a hive later if you recover it.
  • If the drive is physically failing or the data is critical, stop and consult a professional recovery service — attempts can make recovery harder and more expensive.
  • Success depends on how much was written to the disk after the account was removed; the more you used the machine, the smaller the chance of full recovery.

Recommended Answers

All 5 Replies

Member Avatar for mjdodd

another way but more tiresome but can be efective is to get a program (there are a lot of free ones or a linux disk) that can boot from CD and then look directly at the hard drive. If you do this you may see in the index entries that start with a question mark '?'. these are entries that the computer thinks have been deleted (such as your user account documents etc) but they can be recovered if they have not been written over. To do this you will need to copy those files and then rename them removing the '?' mark.
M

Member Avatar for caperjack

I just went on http://www.piriform.com/recuva and you can only download if I pay for it.

click on one of the links by the red check mark

recuva.PNG 80.19 KB
Member Avatar for jaydeee

guess this one will work:
slave your hdd to another computer and get your file. I am thinking that your files are not actually deleted after you've deleted the account.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.