Recovering Deleted Files

My dad was getting a missing MBR error on his Vista machine. After trying some basic options, I started poking around with the command prompt in the Windows Recovery Environment. After following the procedures listed here, I realized that the C:\Windows folder was completely missing as well as my dad's folder in C:\Users.

Booting off of a Knoppix disk, I've used PhotoRec and TestDisk to scan for deleted files and copy them over to another hard drive.

At this point I'd like to see if I can rebuild the old file system (if at all possible). Otherwise, I'm going to have to reinstall Vista and sift through the undeleted files, which I'd prefer not to do if there are other options.

Any suggestions?

 

What is the exact error you see when trying to boot the Vista machine?

Are you certain when viewing the filesystem from Knoppix that you were looking in the correct partition for Windows and Users? Most Vista installations have a very small 100mb "System Reserved" partition that contains only boot files. The Windows and Users folders are on the main OS partition.

 

Hi my friend , my suggestion is to use this utility

http://www.piriform.com/recuva

showing this video

http://www.youtube.com/watch?v=qbn2FCiqXdQ

try it !! :cool

 

I had not thought to use recuva. At your suggestion, I installed the drive in question into a system that had Vista running on it already and I'm running the scan now.

I'll post back if I have any additional problems.

 

While playing around on the hard drive, I found a folder in the root drive marked BACKUP that seems to have a complete copy of the lost file structure. It was created about the time that my dad's computer stopped working. I'm thinking that the computer must have been running a back up routine, but it crashed somewhere and when I tried system repair/restore the process had been so badly damaged that those tools wouldn't work.

Is it possible to restore the OS/Programs/User Data from the backup folder? If so, how do I go about doing it? I'm assuming that simply copying and pasting the folder's contents won't work, but if I'm wrong, just let me know!

 

You have the HD attached to a working computer.
Go to Start/Orb and type in disk management and hit <enter>
In the window that opens look at Disk 1 which should be your dad's HD. What partitions do you see and are they all NTFS and how big is each one and how much space is used on each one?

Basically the information from the top half of the window for your dad's HD.

 

I think you meant type diskmgmt.msc. In any case, the two partitions I see are both NTFS and marked healthy. The active one is 106.64 GB with 25.2 GB in use and the other is 5.15 GB with 3.07 used. Both are primary partitions.

 

I was hoping that you were looking at the wrong partition and somehow the Windows OS partition was missing/damaged. It seems you really are missing the Windows folder.

What folders are left in the root drive? Program Files and Users are still there but no profile for your father?

If you can browse the Windows and Users folders in the backup folder I don't see why you couldn't COPY them to their original locations and see if they would work. If folders exist with the same name I would rename the current folders rather than overwrite them so you could undo if you needed to.

Could a program like spacesniffer give you a better view of the OS partition to figure out where things are and if there are duplicates. http://www.uderzo.it/main_products/space_sniffer/

 

The folders that are there are: BACKUP, System Volume Information, Temp and Users.

Apparently, the "complete pc restore" option in the WinRE option uses the BACKUP folder for restoration. Unfortunately, it won't restore a drive from the same drive (as far as I can tell), so I'm copying it through a direct cable connection (which is going amazingly slow for some reason, maybe I should use a cross over cable).

I hope to try the CPCR tomorrow.

 

I ended up copying the files from the BACKUP folder right into the root of the drive. On start up, I had to do a couple more tweaks in the recovery environment, but everything works fine now.

Just to be sure, I'm going to run clamtk to make sure there is nothing insidious hanging out.

Thanks for everyone's help.