Welcome to the Lounge

Nelek22-Dec-17 1:52

22-Dec-17 1:52

I would do the same, but I have never got a call like that.

When I reached there, my relative was buying the ITunes Code they wanted. But then I took over the conversation and started making obvious that they were lying. Pity is... it was already too late for the data. Had my relative called me at the begining Sigh | :sigh:

M.D.V.

If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.

Richard MacCutchan21-Dec-17 6:48

Richard MacCutchan

21-Dec-17 6:48

I had a 2-3 minute argument with one guy when I told him he did not work for Microsoft, and he knew nothing about computers. Quite amusing really.

H.Brydon26-Dec-17 17:02

H.Brydon

26-Dec-17 17:02

Richard MacCutchan wrote:
he did not work for Microsoft

Richard MacCutchan wrote:
he knew nothing about computers

Sounds legit to me.

I'm retired. There's a nap for that...
- Harvey

Munchies_Matt21-Dec-17 21:45

21-Dec-17 21:45

If you get any call like this tell them to f*** off.

Cornelius Henning21-Dec-17 7:17

Cornelius Henning

21-Dec-17 7:17

Quote:
with a pronounced Indian accent

I do believe that may apply to a good proportion of legit Microsoft software guys! Laugh | :laugh:

Get me coffee and no one gets hurt!

Ehsan Sajjad8-Jan-18 7:10

Ehsan Sajjad

8-Jan-18 7:10

Just wondering do Microsoft guys would really call in reality and say that your system has a security breach please fix it! i mean they are busy guys, why they would care any one and there are so many Windows users around the world, how one could track and see who is having security breach Laugh | :laugh:

dandy7221-Dec-17 4:54

21-Dec-17 4:54

So have they actually deleted data, or encrypted it? I don't understand what the motive would be for anyone calling others over the phone, only to delete data in some unrecoverable fashion.

I don't know about your/his NAS's capabilities, but if this was a Windows machine, I'd be looking for volume shadow copies. See vssadmin.exe, or ShadowExplorer for a GUI version.

Nelek22-Dec-17 1:56

22-Dec-17 1:56

They have deleted. When I came over and switched the PC on again I could see the different devices and they were empty. Windows login was protected with a password due to the remote management tool of them, but the rest was all reachable.

dandy72 wrote:
I don't understand what the motive would be for anyone calling others over the phone, only to delete data in some unrecoverable fashion.

Money... plain and simple dirty money...

dandy72 wrote:
only to delete data in some unrecoverable fashion.

that's what I hope they were not that professional, and I can maybe (with luck) recover something.

dandy72 wrote:
but if this was a Windows machine,

it was a windows 7 machine

dandy72 wrote:
I'd be looking for volume shadow copies. See vssadmin.exe, or ShadowExplorer for a GUI version.

Thank you very much for the tip, I will have a look

M.D.V.

dandy7222-Dec-17 3:20

22-Dec-17 3:20

Nelek wrote:
Money... plain and simple dirty money...

So I still don't understand. How do these guys profit from data being deleted and unrecoverable?

Nelek wrote:
it was a windows 7 machine

You also mentioned a NAS however - unless the NAS machine is itself running Windows 7, it wouldn't be creating volume shadow copies.

Still, let me know if this helped - this is a really poorly known and under-appreciated feature, and has allowed me to recover files long thought to be lost (including some files some people would rather have not had me recover for them) Wink | ;)

Nelek22-Dec-17 9:40

22-Dec-17 9:40

dandy72 wrote:
How do these guys profit from data being deleted and unrecoverable?

They try to make you believe that if you pay you get the data back. A sort of ransom. The problem is... they can'T beacuse to copy the hard drive a lot of time would be needed.

If the drives would have been encrypted, then there is still a possibility to recover it. Another thing is if the actually give the code after getting the money or they just ask for more.

About the NAS... I don't think it was doing shadow copies, not sure if that NAS was even able to do them. Anyways thank you, I will dig about the feature a bit. Since I suppose I will have to bring everything back to life, I will try to make some changes.

M.D.V.

dandy7222-Dec-17 17:19

22-Dec-17 17:19

A NAS on its own wouldn't know anything about shadow copies - this is a feature of Windows and NTFS.

Nelek22-Dec-17 22:59

22-Dec-17 22:59

Oh... ok. Thanks for the tip

M.D.V.

dandy7223-Dec-17 3:33

23-Dec-17 3:33

Still worth keeping in mind when trying to recover stuff from your PC.

Nelek23-Dec-17 4:55

23-Dec-17 4:55

That's why I said "thanks for the tip" Wink | ;)

M.D.V.

Cornelius Henning21-Dec-17 5:24

Cornelius Henning

21-Dec-17 5:24

I know this is not the kind of advice you want right now, but let him consider backing up data to the cloud. I have excellent results with Microsoft's OneDrive. Even if OneDrive data gets deleted, it is kept in a cloud recycle bin for a month and can be restored easily.

Get me coffee and no one gets hurt!

Nelek22-Dec-17 2:01

22-Dec-17 2:01

I don't take it bad. I know about it, but the problem I see with this is... encryption.

He could not manage to follow the easy advice of "don't keep all USBs plugged at the same time when you don't need them"...

Sadly I don't think he is going to leaarn from this that much. So keeping a healthy encrpytion and backing up in the cloud... I see it a bit unrealistic.

I will check which options there are anyways. Thanks

M.D.V.

Munchies_Matt21-Dec-17 21:47

21-Dec-17 21:47

Look in the recycle bin, and secondly get an undelete program.

When a file is deleted in windows its entry in the FAT has a ~ put at the start. That is it. (at least I am pretty sure it is that way, if memory serves me correctly).

SO undoing that restores the file.

It is very easy.

Nelek22-Dec-17 2:07

22-Dec-17 2:07

It was Windows 7 (NFTS).

The bin was empty, I suppose they used something similar to "Caps + Delete" (delete without sending it to the recycle bin) or an internal deletion of the "Remote Desktop" they used.

My relative says he saw a popup about a confirmation to delete the data (that's when he realized what was really going on). The confirmationw was not the typical "windows popup" it had another colours, he said.

I am hoping that they didn't use a recursive deletion or things like that, just a "fast and dirty" deletion, that might be undone at least partially (every byte of data back will be better than nothing).

The problem is... windows is fvcked up, so I will have to reinstall from the scratch in C:, the Data were in D: but I am not sure if your idea will work after a fresh installation

M.D.V.

Munchies_Matt22-Dec-17 21:25

22-Dec-17 21:25

Why not boot off a rescue disk and run an undelete?

Nelek22-Dec-17 23:08

22-Dec-17 23:08

This is going to be my first try. I have a couple of versions of Hiren's (10.1, 13.3) to boot in DOS or in miniXP is good. But I am not sure if the tools contained are that good.
I too have an old linux bootable CD somewhere (that I have to find first). But the good undelete software is what I am missing.

If it doesn't work as expected, then Install windows in C: and run rescue in D:
At least this is the only thing where he was disciplinated, he saved everything in the "data" partition and keeping "system" clean (I was doing restore image backup, updating and creating new image a couple of times a year), but keeping the "data redundant drive" always plugged in... D'Oh! | :doh:

(I hope he learnt from this experience)

M.D.V.

Munchies_Matt23-Dec-17 0:24

23-Dec-17 0:24

There must be a bootCD+undelete combo on the net somewhere, this is classic rescuse stuff.

What I always do is keep my OS on one drive, and all my data on another, and also put backups on that data drive.

Then if I get s problem I can just wipe the OS drive with impunity.

It is a bit of a faf to set up, but gives you 100% antivirus/anti scam protection.

Nelek23-Dec-17 0:49

23-Dec-17 0:49

I do similar for me, with him is partitions separated, but not drive separated. Second partition is the one that had the data that got deleted (with OS backup images inside, that's why I have to start over again). And the external drives (NAS and USB) were connected too, so redundancy went to hell too.

That's why I was thinking on reinstall windows in C: partition, leaving D: (Data) untouched.
I think it is better to concentrate my effors on the main HDD, that had the most actual data and will probably be easier for the tools.

But I will have a detailed look to the bottable cds first. If I can do everything in low level from the booted environment I think it might get better results.

M.D.V.

Jeffamn22-Dec-17 3:07

Jeffamn

22-Dec-17 3:07

Unless they used a program to write over all the data - delete just marks the filename as deleted in the directory. To be able to recover the data - DO NOT write anything to the drives. Use an undelete program or a data recovery service like Geek Squad at Best buy - looks like the cost is $200 to $1400.

Best Buy Geek Squad Data Recovery page here [^]

Nelek22-Dec-17 9:43