Member Avatar for mfl8625

Hi,
I have a computer that I issued to another user. Two months later the old user decides to tell me that they would like their archive emails. I logged onto them machine and even though I deleted user profiles, I had not emptied the recycle bin. When I went to look at the specific user his documents and settings did not exist. I looked at the other users that had logged into that machine (it is common here for users to share a machine) and theirs were all present. I am looking for the users .pst file.

I have used three different recovery tools from online and they all pretty much recover the same items. It did find the outlook archive.pst but it was empty. The user cannot remember where he archived too and it is like looking for a needle in a haystack since all searches for .pst's turn up nothing, nada. I have the users archives from 2005 to 2007, 2009 & 2010- just need the 2008. People should not use their emails like a file system.............just an observation!

Any suggestions on software that might dig in deeper to find those deleted sectors? I have tried: Easeus Data Recovery,PC Tools File Recovery & RecoveryFix-PST.

(Windows XP Pro OS/MS Office Pro 2007)

Thanks!

  • 2 Contributors
  • 3 Replies
  • 235 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by gerbil
Member Avatar for gerbil

All recovery softwares head straight for the file tables [master and perhaps the backup]. With an NTFS system there is no other way... the file tables record which sectors are used for each file, a deletion is made by marking those sectors' entries with an altered bit; the table entries [filename and sectors used] remain intact. If both tables are corrupt then the affected files are pretty much lost to all but the most expensive forensic work.
So if you delete a profile [a collection of files and registry entries] then the associated sectors are marked, as mentioned above. If the Recycle Bin is full or a file etc is too big then it won't be placed in the bin. Shift-Delete, an application delete or a cmd line delete won't put them in there, either. Once so marked they can be overwritten at any time. Pretty much, if those apps don't show the profile's files, then they are gone.

Member Avatar for mfl8625

Thanks gerbil. Not what I wanted to hear, but my bad on not backing this up prior.

Member Avatar for gerbil

I could have written that a bit better. Chopping and moving bits garbled it somewhat. What i meant was.. the user profile could not have gone into [or stayed in] the bin otherwise its file table entries would be intact. Outside the bin, sectors marked as deleted are re-usable, hence are not safe. By file tables being corrupt, I meant only the actual entries for the files you seek being broken, not the table integrity lost.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.