Hard Disc Wiped on Laptop

[PaulSB]

So this is not one of those disguised I've screwed up but I'll pretend it's someone else threads!!

My wife works for the NHS and is issued with a laptop for all her computing needs. I've seen this machine from time to time but never taken much notice of it other than trying to help Mrs Paul with any problems she has using software. From memory it is (well was!) running XP Pro with MS Office 2000. I say was because it isn't running anything right now!

Mrs P tells me all staff save their work to a shared drive which I presume updates to a central server which also makes routine backups. Users can save to the Desktop and the local C drive but these files are not on the shared central drive. In Outlook 2000 e-mails in the Inbox (the one at the top of the folder tree apparently) are archived centrally. My wife had another "In Box" below the main one in which she "archived" (I don't think this is correct) e-mails she still had to work with. Apparently the main Inbox capacity is very limited and users have to empty it regularly during the working day. Mrs P is convinced this second Inbox is an archive. My experience tells me this cannot be so but I've tried having that discussion!! I have always understood secondary folders in Outlook are only archived if the user sets up the necessary procedures.

On Monday Mrs P accidentaly pressed a Function key which she says is "the one which restores the laptop when you have a problem." I don't know about this but it seems to me a function key which does an automatic restore is very dangerous and unlikely to exist. The result is her local hard drive has been completely wiped meaning all work saved to the desktop, local HD and crucially 100s of locally "archived" e-mails have been lost.

The tech support guys say they have never seen anything like this and it is not possible to rescue the HD at all.

So two questions - is it really possible to have a single key which can wipe the HD or a combination of accidental key strokes which have this effect? Secondly I've always believed, and have seen, a HD can be rescued even after a total failure of the machine, am I right or wrong?

Any comments or ideas my wife might be able to put to the tech support people would be much appreciated.

thanks...............................

 

[ian turner]

F11 to access the restore partition on bootup but then you would have to select a couple of options at least before you wiped everything.

Er a total failure would imply a dead harddrive which would require a professional company to extract the platters from the drive , mount in a working drive and extract the data assuming that there had been no physical damage to the platters.
This is not the case here.
Had the files simply been deleted then it might be possible that they still existed at least in part as long as no significant file creation had occurred since resulting in the space on the drive being overwritten. Since this is probably overwriting the system partition with another it's debatable as to what is or is not available still.

Try downloading Recuva to another PC then following these instructions to copy and run from a usb drive as installation to the laptop might overwrite the files you are trying to save.

Also query with the IT guy as to whether the email was setup for POP3 or IMAP as the latter would leave the email on the sserver.

 

[Shanks]

Hi Paul, I have to honest and say that the prognosis isn't great for recovery of all the files, although a lot will depend on what this magical button actually did. I agree firstly that I've been playing/fixing/building pc's for some time now and have never seen a 'one button destroy all data' configuration.

If it has just deleted the files then you may get a lot of them back, if it has formatted the drive as well then the chances will decrease.

Forgive me if I'm repeating stuff you know but deleting a file (in windows at least) does not destroy the data, it simply marks the space used as available for being written to again. A quick format will simply declare the whole drive as writeable so it may all be there still. My suggestion would be to remove the drive and install it as a slave drive in a full pc system. Then use some recovery software - there are loads about, although I have had a lot of success with Recover 4 All. This will scan the drive and tell you if there is any recoverable data for no cost. Once you know this you can decide whether to pay for the full programme and get it back.

Be careful not to write anything to the drive as this will overwrite files and you will lose at least a few.

Are you sure there is not a virus at work here? If not then an immediate scan with an up to date AV programme should be the first thing you do.

Good luck

 

[PaulSB]

Thank you Ian, that's an idea I can cope with at my ability level. It seems the IT guys have just written it off and handed over another laptop which only solves a very small part of Mrs Paul's problem.

 

[PaulSB]

Shanks, thank you, yes I could probably cope with that. I'm not a PC guru I can assure you. As I said above the support guys seem to have simply written the thing off. This is the NHS and I have no idea how competent these folk are or for that matter how interested. If it was my work PC/laptop I'd be moving heaven and earth to save it regardless of cost.

I've texted my wife to see if she can get the machine back to try yours and Ian's suggestions at home. I suppose we may face NHS security issues but I just want to give it a go as Mrs P is very upset.

I've lost count of the times I've tried to explain to her the need for proper back up procedures!

 

[ian turner]

Odds on it's overwritten the partition with the restore copy.

If it went through a full windows repair install then you would have a copy of the windows directory,program files directory and documents and settings directory and the outlook files would be there and require importing. But my money is on the overwrite (note this copy will be of used spaced in an empty system and hopefully your outlook pst file or whatever is in space that isn't used so won't have been overwritten).

 

[MockCyclist]

Wouldn't Outlook have been connected to Microsoft Exchange Server running on the "central computer"?

In other words ,e-mails appearing on the local laptop (Mrs P's) are actually on the Exchange Server computer. Even if e-mails were"archived" locally in a .pst file on the laptop it's possible that they still exist on the Exchange Server.

If the "main inbox" really is so short of capacity it can't even store more than a few hours worth of messages, well that'sbad.

So you need to talk to the e-mail administrator rather than the laptop techie. It could be that the e-mails re-appear when the newly rebuilt laptop is re-connected with the e-mail server. This doesn't apply to files outside of Outlook which were saved locally, they will be gone.

 

[PaulSB]

Well a BIG thank you to everyone from my wife. As a result of suggestions here she has discovered her local NHS authority stores / archives all e-mail on a web based "server" and while it will take some time she can access everything which was lost.

The IT guys have formatted the drive and it seems locally saved docs will have gone though I shall have a play around at the weekend. However it now appears much of what was lost can be found on the central shared drive, some of it unexpectedly, and only revisions from the last week or so have been lost. Plus colleagues have copies of docs she revised and the forwarded.

A gentle lesson on backing up will be appropriate at some point in the future

thanks again

 

[ASC1951]

This is why I use Dropbox www.dropbox.com for all my critical data. Thanks to whoever it was on here who recommended it.