Windows Deleted my User Profile, any idea where my data could be?

[Jozth]

Hello!, today I turned on my pc and it started on a temp user profile, then after multiple failed attemps to repair my profile I went to check my profile folder to backup the documents and photos, but theres was no folder and after looking for my data everywhere I wasn't able to find anything.

 

Any idea how to recover it or am i screwed?

[kelvinhall05]

Nice one, Windows.

 

 

Did you update or something? Maybe it's a dead/dying drive or possibly a virus, though I kinda doubt both of those things.

[TheBean]

C:\users?

[stevecat]

Check in your windows.old folder for a users folder that has hidden files (press F10) and click on display hidden files

[Jozth]

C

11 minutes ago, Saksham said:

C:\users?

 

9 minutes ago, stevecat said:

Check in your windows.old folder for a users folder that has hidden files (press F10) and click on display hidden files

Yes C\Users and it's not there at all. There's no Windows.old folder and checking the hidded files options doesn't show anything sadly.

 

I also tried to search (windows search) for the files with no luck.

[Jozth]

6 hours ago, kelvinhall05 said:

Nice one, Windows.

 

 

Did you update or something? Maybe it's a dead/dying drive or possibly a virus, though I kinda doubt both of those things.

Well shit. It's a Ramsonware. It came from an usb of a friend, inside it are a few folder stolen from "c:" like "recovery" with a file that is called "ntuser.sys". Now i don't know what to do.

[TheBean]

malwarebytes. 

hitman pro

 

use these to get rid of the malware. although it will not get your files back.

 

THIS IS WHY YOU BACKUP

[Mark Kaine]

4 hours ago, Saksham said:

THIS IS WHY YOU BACKUP

While that's true,  usually stuff like this ransomware gets backed up with any backups too and as such is not really a solution - outside the small chance it actually didn't get backed up due to a sensible backup schedule like only once a week or so (basically still comes down to luck though)

 

It's similar to Steam cloud backups,  people think they're safe but if your save file gets corrupted it will still backup that save to the cloud overwriting your perfectly fine, not corrupted save file with the corrupted one,  leaving you completely sole (unless you made a real backup to external disk beforehand of course) 

[TheBean]

9 hours ago, Mark Kaine said:

While that's true,  usually stuff like this ransomware gets backed up with any backups too and as such is not really a solution - outside the small chance it actually didn't get backed up due to a sensible backup schedule like only once a week or so (basically still comes down to luck though)

 

It's similar to Steam cloud backups,  people think they're safe but if your save file gets corrupted it will still backup that save to the cloud overwriting your perfectly fine, not corrupted save file with the corrupted one,  leaving you completely sole (unless you made a real backup to external disk beforehand of course) 

when backing up, you can always change the setting so it does not overwrite but instead creates a new backup. this takes way more space, but is much safer. 

you could also do incremental backups which are more resilient to malware than overwrites but do not take up as much space as the one where it creates a whole new copy.

[Mark Kaine]

1 hour ago, Saksham said:

when backing up, you can always change the setting so it does not overwrite but instead creates a new backup. this takes way more space, but is much safer. 

you could also do incremental backups which are more resilient to malware than overwrites but do not take up as much space as the one where it creates a whole new copy.

Noted, still it's not 100% fool proof of course.  

[Jozth]

Good news!!

Today after i did a full virus scan, windows defender (of all things) deleted some files that seemed to be the ransomware. After that i placed back the folders stolen that were on the usb memory back back to were they belong but sadly it had no effect, then I did a error check on the hdd's "chkdsk/f" on command prompt that was done on boot and after that my files where on a folder named "Found.001". All I did was move the files (they where the same as in the user folder) on a folder with my user name and place it on "users" folder on "c:" and voila! after a restart my user was back with nothing missing!!.

 

Thank you guys for your attention and helping me!! 

[Mark Kaine]

Awesome,  good job getting your files back!