chkdsk on W7 startup deleted files ??

[monographix]

Hello.

On windows (7, 64) startup i got (for the first time since i setup this Win 7 system in 2009) a chkdsk initiation on two different partitions ("E:" & "I:") on two different physical drives. "I:" was freshly recovered from accidental deletion so it makes sense. But "E:" is on a physical drive that i never had any issues with either the drive or the partitions nor ever had been subjected to any possibly messy activity.

I think though that , reading the report i attach, chkdsk deleted files from the so far flawless "E:". All the files i tried to find in "E:" from the report are not in the drive. Using GetDataBack didn't find them either ....

1. Is there a way to find out if files (and which ones exactly) were actually deleted from "E:" ? (unfortunately, i have no back up of this partition)
2. If they are deleted, is there a way to retrieve them ?


Thank you

 

[Golden]

Hi,

You could try RECUVA to see, but there are no guarantees.

Regards,
Golden

 

[monographix]

i just found the bootex.log file using Recuva. I dont know if its deleted or not, but i saw it only in the Recuva files list, i couldn't find it anywhere outside Recuva. And comparing it with the event log in Event Viewer, the bootex.log is the FULL log with more process information AND the FULL list of files that chkdsk DESTROYED yday .... I thought these would be all the files, reported in the Event Viewer and was some partial comfort to see that some good percentage of them i have copies of in another drive, but now i see in bootex.log the whole extend of damage freaking chkdsk has done and i need to eat a bucket of xanax ...

Any way of retrieving chkdsk wiped files? MFT restoration maybe ?


[ Can we confirm that the Event Viewer log information for some reason is shorter than its corresponding bootex.log ? In cases of large amount of edited files i guess ? ]

.

 

[karlsnooks]

I suggest that you immediately make a backup of all data dear to your heart.

Your problem is not chkdsk, but rather either malware or hardware failing or corrupted system files.

Please run a FULL SCAN by the Microsoft Standalone System Sweeper. After completion, attach the log(s) mentioned in the following write-up to your next post.

PUT SYSTEM SWEEPER ON A USB STICK
System Sweeper, https://connect.microsoft.com/systemsweeper, allows you to start an infected PC and perform an offline scan to identify and remove viruses, rootkits and other advanced malware. System Sweeper is a free standalone, bootable malware and virus remover from Microsoft.

Safety Scanner, Microsoft Safety Scanner - Antivirus | Remove Spyware, Malware, Viruses Free, is free, downloadable, provides on-demand scanning and helps remove viruses, spyware, and other malicious software. It works with your existing antivirus software.

If the target computer has a working internet connection, then you may prefer to use the Safety Scanner.

NOTE: A fine tutorial on the System Sweeper is:
How to use the Microsoft Standalone System Sweeper


Download System Sweeper (about 576 kB):
https://connect.microsoft.com/systemsweeper

Insert 256 MB or larger USB stick into a usb port.

Run the downloaded program--mssstool64.exe or mssstool32.exe

Choose the option to install to USB.
Caution: The install program will format the usb stick.

The install program will download about 200 mB more.

After the install is finished, leave the stick in the usb slot.

Run the program you downloaded once again.

This 2nd run, and any subsequent runs, will download the very latest anti-virus definitions (about 60 mB).

To keep System Sweeper up-to-date, simply reinsert the usb stick and run the installation program, mssstool64.exe or mssstool32.exe, again.

The initial, full scan by System Sweeper can easily take several hours, but subsequent quick scans will be shorter.

Remember, your computer is being very thoroughly checked for all types of malware.

The results of System Sweeper will be in:
\Windows\Standalone System Sweeper\Support as one or more files with a LOG extension which can be viewed with Notepad.