Jump to content


Photo

retrieving deleted files - ad aware


  • Please log in to reply
5 replies to this topic

#1 aline

aline

    Newbie

  • Members
  • Pip
  • 3 posts

Posted 19 November 2006 - 08:24 PM

I did a scan with AD-AWARE without using proper security measures and have lost
over 1,000 documents including several years work of family
history!! Please help....how can I retrieve deleted files
from ad aware scans? Is there a way to contact support
other than this forum?

aline

#2 spike-nz

spike-nz

    Advanced Member

  • Volunteer Security Advisor
  • PipPipPip
  • 3092 posts

Posted 20 November 2006 - 04:53 AM

Hi aline,

Not sure how an Ad-Aware scan achieved that but unless you deleted the files instead of (or after) quarantining them, yes you can recover them. That is, it it was the Ad-Aware scan that did it...

If you have your Ad-Aware set to the default safety settings (click the "Configuration Cog Wheel" icon at the upper-right of the main Status Screen):

AAW_Config_General.gif

In the General section, under Safety, you should have a green tick beside the options "Automatically quarantine objects prior to removal" and "Safe mode (always request confirmation)". If you do then go back to the main Status Page:

AAW_Status_Screen.gif

Click on the link in the lower-centre "Open Quarantine list".

If the above options were set correctly, you should find a quarantine file dated the day that you did the scan. Double-click it and you will get a log of the quarantined items. If it is the correct Quarantine file, close the log, then click on "Restore" (in the bottom-right corner).

I hope that that gives you back the files that you are looking for.

Regards,

Spike

#3 aline

aline

    Newbie

  • Members
  • Pip
  • 3 posts

Posted 20 November 2006 - 05:47 AM

hi spike,

thanks for your reply....yes, unforntunately i did not have those safety measures ticked
and did not quarentine my files.

i rarely used ad-aware and didn't realize it's potential....at some point i must have unclicked
the quarantine default setting

so short of using an "undelete" program...there probably isn't much i can do...is there?

boo hoo
aline

#4 spike-nz

spike-nz

    Advanced Member

  • Volunteer Security Advisor
  • PipPipPip
  • 3092 posts

Posted 20 November 2006 - 11:21 PM

Hi aline,

Sorry to hear that. At the moment, I use Norton Systemworks 2005 (2006 is a bit too resource-heavy for my liking), which includes a module that keeps copies of deleted files for a given number of days - I take it that you don't have anything like that?

If the documents really are vital, you should be able to find a computer forensics expert somewhere near your location - deleted files are not actually deleted, you just can't see them any more. May cost a bit but the files should be recoverable, even if their location has been over-written.

Regards,

Spike

#5 aline

aline

    Newbie

  • Members
  • Pip
  • 3 posts

Posted 21 November 2006 - 06:00 PM

Hi Spike,

No, I don't have the Norton program, but I will check around to see if I can find help in recovering the files.

I've been told it is a bad idea to keep using my computer in the meantime, but I have too much work pressing not to. How long are deleted files usually recoverable? Or does that vary?

Thanks for your help. Live and learn!

Aline

#6 spike-nz

spike-nz

    Advanced Member

  • Volunteer Security Advisor
  • PipPipPip
  • 3092 posts

Posted 23 November 2006 - 07:59 AM

Hi aline,

Depends what, and how often, info is over-written where the files were.

Have only a vague idea as to how they do it - but hey, look at what they recovered from deleted emails at Enron and MS ( to name but two).

For what it's worth, I'd get the files recovered sooner rather than later. The more that is over-written, I guess the harder it would be - but that is only a guess :)

Good luck,

Spike




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users