Windows 10 - disappeared files

[GoSeigen]

While one of our employees was using our Win 10 desktop some files disappeared. Can anyone help diagnose what might have happened?

All the missing files are from within a single user directory (on the Desktop) and its nested subdirectories. All files and subdirectories are missing except temporary files and directories which contain temporary files (names prefixed with a ~). The top level directory is of course still there. All the affected directories in the hierarchy now have the same modification date/time during the period that this employee was working on the machine. It appears no other directories were affected. I've tried not to touch anything much in my diagnostics but I did make a zipped file of the folder to confirm that it is empty: the zipped file was only 50k so I guess all the useful stuff is gone.

The obvious cause is that the user deleted the files by mistake, unfortunately they are not in the recycle bin. My knowledge of Windows is pretty sketchy, so value input from experts.
-Is it fairly easy to delete the contents of a directory like this and would the temporary files normally be left in place as described above? Wouldn't the deleted files normally end up in the Recycle Bin?
-could the files have been dragged somewhere else? If so I'd guess the temp files would be moved too?
-Is there another possible explantation e.g. change of permissions for the files, making them hidden etc? Could it be a well known but harmless prank?


Finally can anyone recommend a good (preferably free) undelete utility for Win 10? I will of course download it to a USB drive and run it from there. A quick google search suggested Recuva.

TIA.

GS

[ReformedCharacter]

-Is it fairly easy to delete the contents of a directory like this and would the temporary files normally be left in place as described above? Wouldn't the deleted files normally end up in the Recycle Bin?

No, not necessarily. Shift+Delete will delete files without the use of the RB.

-could the files have been dragged somewhere else? If so I'd guess the temp files would be moved too?

Yes, dragging the files somewhere else is a possibility. Try searching for a missing file from Windows Explorer.

-Is there another possible explantation e.g. change of permissions for the files, making them hidden etc? Could it be a well known but harmless prank?

I don't think changing permissions would make the files disappear. I haven't heard of such a prank.

Finally can anyone recommend a good (preferably free) undelete utility for Win 10? I will of course download it to a USB drive and run it from there. A quick google search suggested Recuva.

I haven't used Recuva but it looks like it should do as well as any other recovery program.

Good luck!

In the light of this please consider a backup strategy

TIA.

GS

RC

[DrFfybes]

My gut feeling is that unless they were consciously deleted - either shift and del or empty the basket on logoff (never a good thing IMO) then they have been moved by accident.

I've done this on both a laptop and desktop, I slid my finger across the pad and managed to pick up a folder and drag it into another one on the same disk. I have once done it on a desktop doing a security scan/update in the background where think I got ahead of it and clicked and moved at the same time.

Paul

[mc2fool]

-could the files have been dragged somewhere else? If so I'd guess the temp files would be moved too?

Yes, it doesn't take much of a klutzy slip to drag a whole folder tree into another, in particular when using the folder tree pane in Explorer. It's possible some temporary files didn't get moved if they were in use by whatever application was in use at the time.

I'd suggest opening Explorer and looking in the folders immediately above and below to the one in question, and working up/down from there.

[Urbandreamer]

It's a bit late, but can I suggest learning from the experience.

I'm not convinced of the idea of storing stuff in directories under desktop. But if you must then ensure that there is a good backup policy in place.
A script that runs from scheduler will do the job.

As I say I'm not convinced with the idea of storing stuff under desktop, historically Microsoft has felt that to be their domain. You can put desktop and documents upon a different partition. If you do so, you may find that any changes that Microsoft make leave that partition alone. Though you might wind up with their defaults and have to change where things point to.

Sorry, but I can't help recovering the files. Though if they have been moved, you could use the search facilities to find them.
https://support.microsoft.com/en-us/win ... 3fdba418d2

[swill453]

If the directories (folders) are all still there and contain temporary files, then it hasn't been moved with a simple drag and drop.

Maybe a search for *.* then a delete might have zapped all but the temporary files.

Scott.

[Redmires]

I've used Recuva many times and if the files have been deleted then it should find them. Note: it will probably find thousands of files and take some time to complete the scan. You can sort the columns into alphabetical order or size order etc and it will tell you if the files are recoverable (green) or not (red). Recover the files onto a separate device, like the USB stick. Good luck.

[mc2fool]

If the directories (folders) are all still there and contain temporary files, then it hasn't been moved with a simple drag and drop.

Unless the hapless user Skiped the files it couldn't move.

[torata]

In case the files have been accidentally moved elsewhere, I find the search tool 'Everything.exe' to be far better than the Windows built in search tool.
There's a portable version available.
https://www.voidtools.com/downloads/

torata

[GoSeigen]

-could the files have been dragged somewhere else? If so I'd guess the temp files would be moved too?

Yes, it doesn't take much of a klutzy slip to drag a whole folder tree into another, in particular when using the folder tree pane in Explorer. It's possible some temporary files didn't get moved if they were in use by whatever application was in use at the time.

I'd suggest opening Explorer and looking in the folders immediately above and below to the one in question, and working up/down from there.

One scenario I should consider is whether the employee attempted to drag the folder to a USB drive (it contained business information). On a Mac dragging to a different disk volume performs a copy by default leaving the original files unaltered. Would it be the same with Windows, or would the files be moved (apart from the temporary ones)?

GS

[Urbandreamer]

Yes, it doesn't take much of a klutzy slip to drag a whole folder tree into another, in particular when using the folder tree pane in Explorer. It's possible some temporary files didn't get moved if they were in use by whatever application was in use at the time.

I'd suggest opening Explorer and looking in the folders immediately above and below to the one in question, and working up/down from there.

One scenario I should consider is whether the employee attempted to drag the folder to a USB drive (it contained business information). On a Mac dragging to a different disk volume performs a copy by default leaving the original files unaltered. Would it be the same with Windows, or would the files be moved (apart from the temporary ones)?

GS

Windows changed a decade or more ago to default to copy when drag-n-drop to a different drive.

I do remember losing files using drag-n-drop, but it was pre XP and copying to a network drive.

[GoSeigen]

Hmm, I'm not making much progress with this problem:

-The modification dates for all the affected directories are the same: 17H27 on Christmas day. One staff member was working on the machine around that time, he may have woken it from sleep. We interviewed him and he says that all he did was access Chrome which he says was already open. Chrome history shows his activity, one page access at 17H27 and the next few about 20 min later. The coincidental time is interesting, could this have been a page refresh from when the machine was woken?

-Recuva was interesting: many files listed, and of the non-system type files area most of the listed deleted files were actually from the affected directory. Bingo! However, they were mostly marked as unrecoverable, having been overwritten by some other file -- but then the files that had overwritten them seem to be older ones dating back months or years. Strange. I can't imagine this is a simple file system/directory corruption issue because of the very specific pattern of deletions and remaining files in the multiple nested folders. I'd have expected Recuva to find a few files that were fully recoverable given we've not done much since the apparent deletions. So is it just not doing its job very well or is something else going on??

-Searching using Windows search didn't turn up copies of the missing files. I haven't tried Everything.exe yet because it wants to index the volume and I wouldn't want the index to overwrite anything useful.

-I've tried looking at timestamps of other stuff accessed around the same time but haven't come up with any clues. Partly this is because I don't know the system very well and where to look. In a mac I'd look at the kernel logs. On the affected machine I tried c:\windows\system* directories. Are there other useful places I could look which might show what was running at the time?



Top possible causes at the moment:
-the user deliberately copied or moved the files.
-The user mis-clicked and deleted them by mistake.
-Some running process cleared out the directory (virus scan/windows itself) when the computer woke from sleep.

Other similar business-related directories on the desktop were not affected, only this particular one. I'd naturally like to know what happened, both to be able to recover the files and to avoid a similar problem in future. I put my hands up, we didn't have these files backed up unfortunately -- partly due to windows-phobia and partly because our internet connection is poor so cloud backup may not work that well.

Any bright ideas gratefully received.

GS

[servodude]

Everything can be told where to put its index - so you could stick that on an external drive?
https://www.voidtools.com/support/everything/indexes/

One thing that MSoft seem intent on is putting a users desktop under the auspices of OneDrive
- if that were enabled https://support.microsoft.com/en-us/office/turn-off-disable-or-uninstall-onedrive-f32a17ce-3336-40fe-9c38-6efb09f944b0 it could give an unexpected path to altering stuff on the desktop?

[GoSeigen]

Everything can be told where to put its index - so you could stick that on an external drive?
https://www.voidtools.com/support/everything/indexes/

I'll try that, thanks.

One thing that MSoft seem intent on is putting a users desktop under the auspices of OneDrive
- if that were enabled https://support.microsoft.com/en-us/office/turn-off-disable-or-uninstall-onedrive-f32a17ce-3336-40fe-9c38-6efb09f944b0 it could give an unexpected path to altering stuff on the desktop?

Great suggestion. We haven't had wifi for a couple of days (using 4G for these posts) so OneDrive wouldn't be syncing. We do get OneDrive messages popping up frequently but I've never paid enough attention to understand what it might be doing. Maybe it'll fix itself when the internet comes back?


GS

[mc2fool]

-I've tried looking at timestamps of other stuff accessed around the same time but haven't come up with any clues. Partly this is because I don't know the system very well and where to look. In a mac I'd look at the kernel logs. On the affected machine I tried c:\windows\system* directories. Are there other useful places I could look which might show what was running at the time?

Right click on the start button (the Windows icon (usually) at the left end of the taskbar) and select Computer Management, then in the window that pops up click on System Tools -> Event Viewer and the Logs under that ... but unless something really leaps out you could spend hours trying to decipher what you see. User friendly it is not!

Everything can be told where to put its index - so you could stick that on an external drive?
https://www.voidtools.com/support/everything/indexes/
One thing that MSoft seem intent on is putting a users desktop under the auspices of OneDrive
- if that were enabled https://support.microsoft.com/en-us/office/turn-off-disable-or-uninstall-onedrive-f32a17ce-3336-40fe-9c38-6efb09f944b0 it could give an unexpected path to altering stuff on the desktop?

Great suggestion. We haven't had wifi for a couple of days (using 4G for these posts) so OneDrive wouldn't be syncing. We do get OneDrive messages popping up frequently but I've never paid enough attention to understand what it might be doing. Maybe it'll fix itself when the internet comes back?

Well, if you already had OneDrive enabled and auto sync uploading the desktop and folders contained therein, it probably won't just fix itself but you should try logging into your online OneDrive account and looking there, in particular in its Recycle Bin. https://onedrive.live.com/login/

[GoSeigen]

-I've tried looking at timestamps of other stuff accessed around the same time but haven't come up with any clues. Partly this is because I don't know the system very well and where to look. In a mac I'd look at the kernel logs. On the affected machine I tried c:\windows\system* directories. Are there other useful places I could look which might show what was running at the time?

Right click on the start button (the Windows icon (usually) at the left end of the taskbar) and select Computer Management, then in the window that pops up click on System Tools -> Event Viewer and the Logs under that ... but unless something really leaps out you could spend hours trying to decipher what you see. User friendly it is not!

Thanks for the pointer. I am used to cryptic logs having been an embedded software developer, and the Mac ones are equally unhelpful. In the event nothing stood out in the logs.

In my rooting around I did discover something odd: that an entire copy of the Documents directory seems to have appeared in the Downloads directory. How that happened I cannot imagine. The original is still in its correct location with contents intact. Anyone seen something similar happen?

Great suggestion. We haven't had wifi for a couple of days (using 4G for these posts) so OneDrive wouldn't be syncing. We do get OneDrive messages popping up frequently but I've never paid enough attention to understand what it might be doing. Maybe it'll fix itself when the internet comes back?

Well, if you already had OneDrive enabled and auto sync uploading the desktop and folders contained therein, it probably won't just fix itself but you should try logging into your online OneDrive account and looking there, in particular in its Recycle Bin. https://onedrive.live.com/login/

Once our internet is restored I'll try logging in there and see what I find before taking the machine online.

GS

[mc2fool]

In my rooting around I did discover something odd: that an entire copy of the Documents directory seems to have appeared in the Downloads directory. How that happened I cannot imagine. The original is still in its correct location with contents intact. Anyone seen something similar happen?

The contents of the Documents folder have appeared in Downloads? Or there is now a Documents folder tree in Downloads that has the same contents as the "real" Documents folder tree?

If the latter, are you sure it isn't a link/shortcut to the actual Documents folder? Creating proper unix style symbolic links in Windows is not normal user stuff (it's done with DOS incantations) but shortcuts are easy to create. Try creating/renaming something in the "real" Documents folder and see if it also appears/changes in the one in the Downloads folder.

If not (or if the former above) then it really does seem you have someone with very fat fingers working the PC!

[servodude]

In my rooting around I did discover something odd: that an entire copy of the Documents directory seems to have appeared in the Downloads directory. How that happened I cannot imagine. The original is still in its correct location with contents intact. Anyone seen something similar happen?

The contents of the Documents folder have appeared in Downloads? Or there is now a Documents folder tree in Downloads that has the same contents as the "real" Documents folder tree?

If the latter, are you sure it isn't a link/shortcut to the actual Documents folder? Creating proper unix style symbolic links in Windows is not normal user stuff (it's done with DOS incantations) but shortcuts are easy to create. Try creating/renaming something in the "real" Documents folder and see if it also appears/changes in the one in the Downloads folder.

If not (or if the former above) then it really does seem you have someone with very fat fingers working the PC!

That sounds like an accidental drag.
"Documents" is a bit of a special case in Windows and I think would get recreated if you moved it (and that moving it takes a bit of a settings tweak... having dinner that for my surface book)
But versions of windows do behave differently

[GoSeigen]

I'll look into the symbolic link possibility. I've done nothing for now to avoid further data loss.

Latest on Recuva: the standard setting didn't really help much so I tried a deep search. Six hours later, "Can't index c: Ran out of memory", and no results at all, not even a partial listing. Aaargh!

Just waiting for our internet to be fixed now, almost three days down so far Serves us right for living in the sticks. Is it the same in the GABA, SD, or has Aus got its internet act together?


GS

[servodude]

Is it the same in the GABA, SD, or has Aus got its internet act together?

All systems seem to be up fine; as far as I can tell when I try to access them from the pitiful service here outside Glasgow (I think there's something loose that's getting knocked about by the wind)