New
#1
Must retrieve consecutively scanned files that overwrote each other
Hello,
I scanned two files using a (newly acquired) Kodak i2900 document scanner, and was rushing. I saved both under the same (automatic) name in the same folder, and it didn't ask for overwrite confirmation. But it did overwrite the first statement.
I ran a search for all files modified at the time of scanning--They are all within one minute of each other. In order, I have:
- Prefetch file (LEXEXE.EXE) from system Prefetch folder
- PF file (LEXEXE.EXE) from system Prefetch folder (different hex tag)
- Log from scanner software's Program Data folder
- XML file in scanner software's Program Data folder (different subfolder)
- PF file (LEXEXE.EXE) from system Prefetch folder (all new hex tag)
- PF file (LEXEXE.EXE) from system Prefetch folder (yet another hex tag)
- PF file (TWAINGUI.EXE) from system Prefetch folder
- Shortcut to file name (a PDF document)
- Shortcut to file name (exactly same as #8)
- Shortcut to folder where I saved files
- Ditto #10
- PF file (KSSCFG.EXE) from system Prefetch folder
- Log, as in #3
- PF file (DLLHOST.EXE) from system folder
- HST file from scanner software's Program Data folder
- XML, as in #4
- PDF document using the name I changed it to about 2 hours later
- Ditto #17
- Extensionless {} file from a folder regarding malware
Can anyone please, please, PLEASE help me retrieve the first file?
Can I use some sort of forensic technique to pull data from the prefetch files? The target files are PDFs; I use PDF-XChange Editor. Others in the office have Adobe Pro. The scanner program didn't open up the files, though.
I also wonder if it's still somewhere in the scanner, which automatically turned off after a certain amount of time.
My system is a Dell XPS 8700 running Windows 7 Home Premium 64-bit, with 8 GB RAM, Intel i7 @ 3.4 GHz.
This is . . . really bad for me if I can't retrieve it. I would be VERY grateful for any help in this area!!! (Right now I am in a panic.)
Thank you!