safe mode data lost

[redheaven95]

after i booted in safe mode three days ago the internet browser does not open anymore also some pictures and text file .rtf are gone. its not in the recycle bin and i used several recovery software without success.

[mjc]

Full details, please...

Like,

Why did you boot into Safe Mode?

Are you having any other obvious problems?

Safe Mode, by itself, can't delete anything. All it is, is Windows being started with a minimal set of drivers, in a basic configuration, that almost always works. Your problem sounds more like an infection of some sort...so posting a HiJackThis (http://www.download.com/HijackThis/3000-8022_4-10379544.html)log would be a good idea...

[Paul Komski]

Is data recovery or getting your system fully functional the main worry?

and i used several recovery softwareWhich ones and did they include GetDataBack (http://www.runtime.org).

[redheaven95]

Full details, please...
if i knew whats going on i would not ask for help. do not know what happened files gone

Why did you boot into Safe Mode? obvious problems?
first the internet browser shut down by self in under 10 sec

Is data recovery or getting your system fully functional the main worry?
data recovery(pictures and important text files .rtf) and internet browser

Which ones and did they include GetDataBack.
easy recovery proffesional and file scavanger and recent getdataback also without success

[Paul Komski]

If data recovery is vital then stop booting to the operating system - the longer the time you access the hard drive directly the more likely it becomes that your disappeared data will be overwritten - and that may have already occurred.

If you have a broadband connection it should be straightforward to boot to a Knoppix (http://www.knoppix.org/) or Ubuntu (http://www.ubuntu.com/) Linux live CD to give you temporary internet access. Dial-up can sometimes be configured but is usually tricky particularly from a Linux CD.

The only clever way to attempt recovery is with your drive accessed as a slave or in an external USB caddy or converter from another computer or hard drive. If you want to use your own computer then I suggest you get an external hard drive as large or larger than your current one and then clone your current drive onto it using dd from Knoppix or by using the drive manufacurers own utility from their website and run from a floppy or CD.

Swap the hard drives around and then install GetDataBack (for FAT or NTFS as appropriate) and scan the current drive from the clone you have made. Never run GDB from the drive you are trying to recover from.

Once you have a new hard drive you could alternatively simply install a clean installation onto it (to give you back internet access) and then attempt recovery from your current drive as slave or attached externally.

There are a number of variations on this theme but if GDB doesnt find the files you could try WinHex (http://www.x-ways.net/winhex/) but I would think your only slim hope would be professional recovery.

One word of caution when slaving or attaching any drives to your current installation is that they could then become infected by any virus on your current bad drive. So having an up-to-date anti-virus on any machine accessing your bad drive would be wise.

[redheaven95]

i run recovery software for years on the same drive never anything bad happened i got all lost data back everytime. why is it important to install it to the other drive?

i used kaspersky and found 22 infected files but nothing changed not faster and the data are still missing.

can not install winhex The system cannot find the file specified.
C:\DOCUME~1\x\LOCALS~1\Temp\ARC71\WinHex.exe
C:\DOCUME~1\x\LOCALS~1\Temp\ARC71\language.dat
C:\DOCUME~1\x\LOCALS~1\Temp\ARC71\dialogs.dat
C:\DOCUME~1\x\LOCALS~1\Temp\ARC71\EBCDIC.dat
C:\DOCUME~1\x\LOCALS~1\Temp\ARC71\external.dll
C:\DOCUME~1\x\LOCALS~1\Temp\ARC71\psapi.dll
C:\DOCUME~1\x\LOCALS~1\Temp\ARC71\timezone.dat
C:\DOCUME~1\x\LOCALS~1\Temp\ARC71\zlib1.dll

[Paul Komski]

It's not necessarily the case that anything bad will happen. (1) By all intents and purposes you have a corrupt system on which even WinHex will not install. Why would you trust it? (2) As already mentioned all the time you work from the same partition you risk overwriting any deleted data. It's your data and your look-out.

If you know which virus was infecting you it might be possible to get a better idea of what files might have been infected and how and whether deleted, zeroed, renamed, split.