Friday, I was tasked with restoring a user profile, but I am at a loss as to if there is anyway that can be done at this point. Here’s the scoop:
I imaged the drive using ddrescue -v. Found no issues copying the data, and the report came back with no bad sectors or blocks(nothing was lost). So I proceeded to recover the data. I used diskdigger from Hiren’s boot CD, in combination with Diskinternals(to locate where the information was) to recover at least the data that was in question of being lost. I have successfully recovered the data needed. I then moved on to virus scan, while the drive was out of the PC. Nothing. inserted the drive, ran chkdsk, and sfc /scannow. Still nothing.
Note: During the data recovery, diskinternals states the user profile folder have been deleted. This a company PC, with GPO, and no admin rights to the user. This is Windows 7 x64. Also, this laptop is a Dell, that is used with a Dell docking station, that is docked and undocked all the time with the docking station eject button.
I am lost if there is a way to recover it, and at this point, I am probably just moving on just due to this not being needed for what I am paid for. However, my curiosity has been peaked, and I would love to here any and all insight on this, if any. Thanks in Advance.
-SA Intern / Ex-bench Tech / HelpDesk Tech
4 Spice ups
dbeato
(dbeato)
2
Did you check the computer for any system restore images? You can check if there was a program that allowed the removal of the profile. I would do a system restore after checking if it contains the user profile. You can also review the event logs to see what was done on the system that caused it. Check for any infections and then recommend a backup strategy.
2 Spice ups
