Help! Strange Problem

[nXtGenPC]

Ok so customer brings in Laptop that is asking for Windows Recovery Disk, he wants to be sure that all of the data is backed up before anything happens. So I pop the hard drive out, plug it in to my bench computer via SATA to USB adapter and it comes up fine, but the C Drive is suppresingly empty (showing like 99% Free Space) when I go to the User folder all I see is Administrator and Public, nothing showing that this guys user account was ever there. So now I am sitting here scratching my head wondering what is going on. Deff sounds like a virus but not sure how to fix this, I have seen virus' that do this, but never when it's slaved to another machine

Thanks

[Cadishead Computers]

If it's possible to boot the laptop up, in what ever mode, run unhide.exe.

Failing that, how about Nicks DataGrab / Fabs4tech. Will they see anything on the drive?

I had a similar issue earlier this morning. All start menu items missing, no desktop icons, no my docs etc. After running unhide, (scan took about an hour), all icons are back, my docs etc, but now some of the start menu progs are showing aas (empty).

[nXtGenPC]

Yeah I ran unhide.exe on my bench computer on his drive/ no luck

Client is dropping off the power supply this afternoon so I will further test and post back

[Cadishead Computers]

Whilst its slaved on the bench, could you not try datagrab or fabs?

[nXtGenPC]

Originally Posted by Cadishead Computers

Whilst its slaved on the bench, could you not try datagrab or fabs?

Good point, I'll try data grab now

[MobileTechie]

Look at it under Linux to get a clear view of what is actually there and what might be hidden by Windows. If the folders are not there then they've been deleted by the user or something. Then you're into data recovery.

[ell]

Originally Posted by Cadishead Computers

If it's possible to boot the laptop up, in what ever mode, run unhide.exe.

Failing that, how about Nicks DataGrab / Fabs4tech. Will they see anything on the drive?

I had a similar issue earlier this morning. All start menu items missing, no desktop icons, no my docs etc. After running unhide, (scan took about an hour), all icons are back, my docs etc, but now some of the start menu progs are showing aas (empty).

I'm seeing this alot lately, must be sure not to clean temp files before scanning, sometimes start menu, desktop shorts, etc are moved to smtmp folder, numbered 1-3. However my latest had those folders but empty. Or search for *.lnk

[red12049]

Originally Posted by nXtGenPC

Ok so customer brings in Laptop that is asking for Windows Recovery Disk, he wants to be sure that all of the data is backed up before anything happens. So I pop the hard drive out, plug it in to my bench computer via SATA to USB adapter and it comes up fine, but the C Drive is suppresingly empty (showing like 99% Free Space) when I go to the User folder all I see is Administrator and Public, nothing showing that this guys user account was ever there. So now I am sitting here scratching my head wondering what is going on. Deff sounds like a virus but not sure how to fix this, I have seen virus' that do this, but never when it's slaved to another machine

Thanks

Or maybe the client started a restore, and wiped out his own data...

Rick

[kevinjhaag]

Originally Posted by red12049

Or maybe the client started a restore, and wiped out his own data...

Rick

^^^ +1...What he said.

[dgiles79]

Originally Posted by red12049

Or maybe the client started a restore, and wiped out his own data...

Rick

This would be my guess too. Sounds like he started a restore himself and wiped his data. It's probably going to need data recovery performed on the drive.