Documents disappeard - how to get them back?

[Tribble]

A client has a very strange problem. He works in a legal department and creates hundreds of documents which he saved on his local drive (yes I want to know why he was that stupid too). He has quite a complex folder structure where things are stored in folders within folders within folders etc. Let us say that it is something like this:

Folder 1 --> Folder 2 --> Folder 3 --> Folder 4 --> and here we have 50+ folders containing files. Well they used to contain files. All the files disappeared but the folders remain. This means that something had to go into each folder and remove the files. They are not in the recycle bin. Yes - search could have been run for all .docx files and then they could have been removed that way - but then they would be in the recycle bin. But not all .docx files are gone. Only the ones at this location.

The IT guys have tried a system restore - no luck. They checked for a virus - nothing (they are using some Symantec product).

Although I would love to know how these files went missing, my first priority is to try and get them back. Do any of you know of a good recovery / undelete tool I could use? I can only assume they are there - just removed from the FAT. The chap swears that he did not delete anything and no one else (to our knowledge) has access to his machine.

When will people listen when you send out emails telling them to work off the network drives and not their local drive?

[doo_much]

XP machine?

If the files had indeed been deleted you might try one of these two apps:
http://www.win-freeware.com/REST2514.htm
http://www.pcinspector.de/default.htm?language=1

But maybe hang around till the gurus show up - they might have a better plan or explanation for how it might've happened

[Tribble]

I shall definitely have a look at those. Thanks Doo.

[doo_much]

Google is my friend...

[Tribble]

I will befriend it as soon as I come back. But I would rather try things someone knows will work I am just stumped as to how they disappeared. My feeling is virus but then the IT team tells me nope.

[doo_much]

If people didn't do stupid things on computers, vast majority of the computer industry would be unemployed - and I include you in that!

Haven't tried those apps so better wait for the boffs. Especially for the explanation.

[KALSTER]

I have used Recuva successfully a few times now. Really easy to use.

[Prime]

check the anti virus logs for recent activity.

there is a virus that hides your files and replaces them with exe's

[Bladerunner]

check the anti virus logs for recent activity.

there is a virus that hides your files and replaces them with exe's

To add on to this, make sure hidden files and folders are shown, as well as operating system files. Then check the folders again.

I've used a recovering tool before, but I can't recall the name at the moment. I remember Recuva, which Kalster mentioned, but there was a different one too.

[Tribble]

Thanks. Yes in a perfect world I would assume that IT has checked for hidden properties. I will be checking. That is the first thing I will do. I ran a search to make sure they had not been moved - but if they were renamed and moved - then I am (insert metal object that is twisted into position). I am there again tomorrow so I want to take a few apps/progs that I can try. They have asked the IT Manager for help but he is too busy (and annoyed that the local disc was used I bet).

So thanks for all the suggestions. I love a challenge and cannot wait to see if I can find these things. It was soo easy on DOS - can't be that much harder in Windows.

[Prime]

take a root kit revealer along.

[Tribble]

Good idea - thanks

[Sojourn]

there used to be a virus like 6/7/8 years ago that would delete all office doc's - specifically office docs.
Cannot for the life of me recall the virus, but there was a tool to reverse the damage - although the tool would rename found files like excel0001.xls - user then had to open each file and rename as required.