recover data from deleted user accounts

dansilva · 05-08-2005, 03:10 PM

if an XP user deleted some of his/her user accounts (lets say there were 4 accounts i.e. User 1, User 2, Guest and Admin) assuming all the accounts were deleted except for Admin, how is it possible to recover the data that were in deleted user accounts?

UndeadInsanity · 05-08-2005, 04:55 PM

I'm quite confident that this isn't possible.

Once the accounts are deleted, all files associated with that account are also removed.

fachim · 05-09-2005, 01:59 PM

some possibility,

please check wether you just delete the account of those user not include the files related to this. I mean documents, desktop and settings.
if the deleted account still not emptying the recycle bin yet, you still have it on their recycle bin folder.

Scrat · 05-09-2005, 02:07 PM

Go to "C:\Documents and Settings" and see if the deleted account folders are still listed there. If they are, try openning them.
If they are listed there but you are locked out of them, try creating those use accounts again using the exact same user names & passwords as before.

If you cant see the the old user account directories in there, then you could try using a file recovery program, to recover the directory that was deleted when the account was.

**Byteman** · 05-09-2005, 02:38 PM

if they are gone, you could try using a program like restoration . That's what I use, it lets you copy anything that was deleted that hasn't fully been overwritten yet.

dansilva · 05-09-2005, 10:02 PM

ok thanks guys for your help

narafa · 05-10-2005, 05:29 PM

If your system restore is open, you can restore your system to a point before the deletion of the user, retreive the data and then do whatever you want.

If your system restore is shut off, then the only way is using a restoration program as Byteman suggested. I recommend a program called "Recover4All", but make sure you get the version which is compatible with Win XP.

**Byteman** · 05-10-2005, 05:36 PM

System restore will not give you back your user files from the accounts, see the description below (from MS) on what type of files System Restore monitors...

Quote:

System Restore monitors only a core set of specified system and application file types (e.g. .exe, .dll etc), archiving the states of these files before system changes are made. System Restore does not monitor any user/personal data files.

narafa · 05-10-2005, 05:39 PM

Quote:

Originally Posted by Byteman

System restore will not give you back your user files from the accounts, see the description below (from MS) on what type of files System Restore monitors...

I didn't know this tip before Byteman. I thought that the system restore is a complete state restore back in history.

Well, although I don't like system restore and never used it as I hate messing up with the system specially automatic messing

the only solution left is the restoration.

**Byteman** · 05-10-2005, 05:39 PM

doing a bit more research, this is what microsoft says System Restore restores or doesn't restore. (interesting, I didn't know it until now...

)

Restored:
•Registry
•Profiles (local only; roaming user profiles are not affected by restore)
•COM+ DB
•WFP.dll cache
•WMI DB
•IIS Metabase
•File types monitored by System Restore as specified in the SDK document Monitored File Extensions

Not restored:
•DRM settings
•Passwords in the SAM hive
•WPA settings (Windows authentication information is not restored)
•Specific directories/files listed in the Monitored File Extensions list in the System Restore section of the Platform SDK e.g. 'My Documents' folder
•Any file types not monitored by System Restore (.doc, .jpg, etc.)
•Items listed in both Filesnottobackup and KeysnottoRestore (hklm->system->controlset001->control->backuprestore->filesnottobackup and keysnottorestore) in the registry
•User-created data stored in the user profile
•Contents of redirected folders

05-08-2005, 03:10 PM	#1 (permalink)
dansilva Gold Member Join Date: Oct 2004 Location: London UK Posts: 442	recover data from deleted user accounts if an XP user deleted some of his/her user accounts (lets say there were 4 accounts i.e. User 1, User 2, Guest and Admin) assuming all the accounts were deleted except for Admin, how is it possible to recover the data that were in deleted user accounts? __________________ DAN 3:16

05-08-2005, 04:55 PM	#2 (permalink)
UndeadInsanity Bronze Member Join Date: Apr 2005 Location: England - Leicestershire Age: 16 Posts: 62	I'm quite confident that this isn't possible. Once the accounts are deleted, all files associated with that account are also removed. __________________ Intel 2.4Ghz Processor Abit V17 Motherboard 1024MB DDR400 Corsair RAM ATI Radeon X800 Platinum Edition 6.1 SoundBlaster Card 80GB HDD

05-09-2005, 01:59 PM	#3 (permalink)
fachim Bronze Member Join Date: Apr 2005 Location: New Delhi - India Age: 29 Posts: 68	some possibility, please check wether you just delete the account of those user not include the files related to this. I mean documents, desktop and settings. if the deleted account still not emptying the recycle bin yet, you still have it on their recycle bin folder. __________________ Fachim School of Computer & System Sciences Jawaharlal Nehru University the art of programming is when you can solve the complexity of real world through your mind and presented on computer.

05-09-2005, 02:07 PM	#4 (permalink)
Scrat Platinum Member Join Date: Aug 2004 Location: Sydney, Australia Age: 27 Posts: 630	Go to "C:\Documents and Settings" and see if the deleted account folders are still listed there. If they are, try openning them. If they are listed there but you are locked out of them, try creating those use accounts again using the exact same user names & passwords as before. If you cant see the the old user account directories in there, then you could try using a file recovery program, to recover the directory that was deleted when the account was. __________________ AMD Athlon 64 3500+, GigaByte GA-K8NS Ultra-939 Ltd Ed. ATI Radeon GeCube 256Mb 9600XT, Compro DVB-T300 Dig/Analog TV Card 2x 1GB, 2x 512Mb DDR CL3 400Mhz PC3200 - Dual Channel WD 120Gb SATA 7200rpm 8MB, WD 80Gb SATA 7200rpm 8MB Excel 108Mb Wireless PCI, WinXP Prof. Samsung CD-R/RW 52-32-52, Samsung DVD 16x reader, LG DVD MultiBurner Benq 17" FP71E 12ms LCD, Logitech LX700 K&M, Logitech G25 Racing Wheel, Logitech Z-5400 FOLDING FOR THE GOOD OF MANKIND!! Team 44358

05-09-2005, 02:38 PM	#5 (permalink)
Byteman Malware Destroyer Join Date: Apr 2005 Location: Hurricane Heaven... still Posts: 1,093	if they are gone, you could try using a program like restoration . That's what I use, it lets you copy anything that was deleted that hasn't fully been overwritten yet. __________________ Don't byte off more than you can chew...

05-09-2005, 10:02 PM	#6 (permalink)
dansilva Gold Member Join Date: Oct 2004 Location: London UK Posts: 442	ok thanks guys for your help __________________ DAN 3:16

05-10-2005, 05:29 PM	#7 (permalink)
narafa Gold Member Join Date: Apr 2005 Location: Egypt Age: 29 Posts: 450	If your system restore is open, you can restore your system to a point before the deletion of the user, retreive the data and then do whatever you want. If your system restore is shut off, then the only way is using a restoration program as Byteman suggested. I recommend a program called "Recover4All", but make sure you get the version which is compatible with Win XP. __________________ - Intel P4 1.8 Ghz - 512 KB L2 Cache - GigaByte MoBo with built in sound - 384 MB SDRAM PC133 - GeForce 2 MX 400, 64 MB - 80 GB Segate HDD + 80 GB WD HDD - 52X LG CD-ROM - 52X-24X-52X LG CD-RW - LG 14" Monitor :mad: - NIC 10/100 - Rockwell Internal Modem - ADSL 256 Kbps :mad: - Generic Floppy, Keyboard, Mouse & Speakers Protected by Norton Corporate Edition & Sygate Personal Firewall If you are dead sure that you are right, then probably the rest of the world is WRONG!!

05-10-2005, 05:39 PM	#10 (permalink)
Byteman Malware Destroyer Join Date: Apr 2005 Location: Hurricane Heaven... still Posts: 1,093	doing a bit more research, this is what microsoft says System Restore restores or doesn't restore. (interesting, I didn't know it until now... ) Restored: •Registry •Profiles (local only; roaming user profiles are not affected by restore) •COM+ DB •WFP.dll cache •WMI DB •IIS Metabase •File types monitored by System Restore as specified in the SDK document Monitored File Extensions Not restored: •DRM settings •Passwords in the SAM hive •WPA settings (Windows authentication information is not restored) •Specific directories/files listed in the Monitored File Extensions list in the System Restore section of the Platform SDK e.g. 'My Documents' folder •Any file types not monitored by System Restore (.doc, .jpg, etc.) •Items listed in both Filesnottobackup and KeysnottoRestore (hklm->system->controlset001->control->backuprestore->filesnottobackup and keysnottorestore) in the registry •User-created data stored in the user profile •Contents of redirected folders __________________ Don't byte off more than you can chew...

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode