[REQUEST] Windows Reset Itself

[Appletax]

Customer came home from vacation to find all their data gone. The PC was off the whole time. It's as if Windows reset itself. They had to set it up like a new computer. It's not a case of being put into a temporary user account and the old account is still there. There's no Windows.old folder, either.

I made a sector-by-sector backup to be safe.

R-Studio doesn't show anything.

Using Recuva currently. Only looking for Pictures at the moment, but there's 500,000+ of them and it's not even at 1/4 of the way done. That's insane.

The customer mainly needs their Quickbooks data.

What to do?

 

[Blues]

I might stop the image search and start searching for the QuickBooks data file also many newer quicken products include a cloud backup piece have you checked to see if there is one?

 

[britechguy]

I also dislike Recuva and strongly prefer TestDisk for situations like this. And limiting TestDisk to specific file classes or even selected extensions is easy.

Something's amiss here about what the client is reporting, that's for sure. If a computer that's not on can do something like this, I'll eat my hat! I'd be willing to buy some sort of really, really odd happenstance had the machine been left on, but off, no.

 

[Appletax]

I might stop the image search and start searching for the QuickBooks data file also many newer quicken products include a cloud backup piece have you checked to see if there is one?

Yea, the HDD is healthy, so I figured it didn't matter what I started with, but it makes way more sense to start with looking for what I need lol.

I also dislike Recuva and strongly prefer TestDisk for situations like this. And limiting TestDisk to specific file classes or even selected extensions is easy.

Something's amiss here about what the client is reporting, that's for sure. If a computer that's not on can do something like this, I'll eat my hat! I'd be willing to buy some sort of really, really odd happenstance had the machine been left on, but off, no.

That has not been updated since 2019. That's not bad, but eventually will want to switch to something that's kept up-to-date, yes?

Maybe a Windows update messed it up. Glitches.

Recuva is owned by Avast! now so I'd rather use something else.

I am going to try TestDisk.

 

[britechguy]

Maybe a Windows update messed it up. Glitches.

Those can't run when a machine is powered down, and if you powered a machine up and an update were to be applying, that's almost impossible to miss if you are physically in front of the machine. And I have never, ever, seen a "bad update," be it Feature Update or Cumulative Update, result in a "freshly reset" state afterward.

As others have said, "Clients lie." I just don't believe the chain of events reported, and never will.

Of course, what I, or you, or anyone else believes doesn't change the current predicament one bit. It's still a data recovery situation.

 

[Blues]

I am preparing for the new movie "@britechguy east his hat"


FYI for those who don't get the reference

 

[Appletax]

I tried a few data recovery programs:

- Recuva - awful
- Test Disk - awful
- Wise Data Recovery
- Easus Data Recovery Wizard
- Disk Drill - freaking amazing

Love Disk Drill !!!

 

[NviGate Systems]

If you look at Event Viewer, you should be able to narrow down the date and time the new OS started.

Perhaps someone was house sitting or someone they know who has a key?

Sounds fishy.

 

[HCHTech]

So no evidence of the old user account on the disk at all? What about a .bak profile in the registry? Details, man - we need details!

Perhaps someone was house sitting or someone they know who has a key?

I like this theory. Maybe said housesitter was looking at something they didn't want evidence left behind for? As with all of these situations, I cheerfully say "No problem, we'll just restore from your backup. You have a backup, don't you?"

So step 1 - attempt data recovery. Step 2 - sell them a backup solution.

 

[nlinecomputers]

Botched Windows update. It didn’t happen while they were gone. It happened when they first booted it up upon returning. There’s no windows.old directory because they f’d around too long before calling @Appletax and Windows automatically deleted it. You only 3 days…

 

[nlinecomputers]

And more likely the upgrade began before vacation and they were pressed for time and powered it off to head out on vacation. Which meant the three days were spent while they were gone.

 

[sapphirescales]

I tried a few data recovery programs:

- Recuva - awful
- Test Disk - awful
- Wise Data Recovery
- Easus Data Recovery Wizard
- Disk Drill - freaking amazing

Love Disk Drill !!!

R-Studio is leagues above everything in that list. Although you're right, Disk Drill is the best in the above list.

Disk Recovery Software and Hard Drive Recovery tool for Windows, Mac, and Linux

R-TT offers disk recovery software and hard drive data recovery tools. Network and RAID support.

www.r-studio.com

What I like about both R-Studio and Disk Drill is they have Mac OS & Linux versions. A disk that won't mount in Windows will frequently mount just fine in Mac OS and Linux.

 

[nlinecomputers]

You shouldn't use Windows-based tools for data recovery. Windows will modify the disk when it mounts it.

 

[Markverhyden]

As others have said, "Clients lie." I just don't believe the chain of events reported, and never will.

I prefer to be a bit more diplomatic. They don't understand how things work. Personally I've seen a handful of "profile disappeared" as in clean install in the past. They were '98 and XP. Never found any evidence of previous profiles but by the same token I don't believe they just up and disappeared.

And lets not forget all those customers who intentionally mis-represent stuff. Back when CompUSA was alive this guy brought in his son's laptop. Screen was smashed, the hinges literally snapped in half, wires ripped out. He told me all his son did was close the lid. Maybe a little too hard. I just looked at him and asked him do you really expect me to believe that. Told him to break off a piece of the hinge with his hands to prove it. Incredibly it worked fine with an external monitor, we would not do anything under the extended warranty, let his son ponder his actions until he can afford a new laptop.

 

[britechguy]

I prefer to be a bit more diplomatic. They don't understand how things work.

Well, I don't say what I said here to a client, that's for sure. But I take your point as well.

My main point is that the statement, "Windows reset itself," makes no sense whatsoever to anyone who knows not only how things work but also virtually all the typical, and some atypical, modes of failure.