NTUSER.dat Corrupt?

[Guest]

Got a friend's PC that is an HP All-In-One, roughly five years old and running Windows 8.1. Late February, a Windows Update was applied that apparently wiped out his pictures, iTunes library of ripped CDs (songs/albums/etc), and Quicken files. It also reset his wallpaper to a Windows default and upon login, a small bubble in the lower right appears telling us that a temporary profile is being used instead of his local one. He is using a Microsoft account and is the only account on the PC. No other issues were present before this Windows Update, and he reports his other files were untouched.

 

I checked the Event Viewer and saw that in late February, there was indeed an error stating that the local profile could not be loaded due to insufficient memory or because of a registry issue, and that a temp one would be used instead. No other user profiles errors were listed before then, nor up till today when I tried to diagnose his PC. After some light Googling, I found out that user profiles and data use the NTUSER.dat file, and that it might have gotten corrupted somehow. I opened the file in Notepad, and everything was mostly gibberish...except I could discern file names of the photos he used to have sprinkled throughout the file, like C://User/Pictures/wedding01.jpg and the like. Are his photos and files still present somewhere? Or they are truly gone?

 

For the record I attempted a system restore, however the last restore point is only to the beginning of this month and nothing changed. I also did verify he was signed in to his Microsoft account and superficially, it appears as if everything is working, no other error messages. Much past that, I don't know what else to do to try and retrieve his lost files. I also don't know if it truly was because of the Windows Update, I'm getting this second hand from him. He's already been warned that 8.1 is no longer supported (mainstream) but doesn't want to shell out for a whole new PC unless his files are truly lost. 

 

Any help would be appreciated, thanks!

[TwilightRavens]

33 minutes ago, Stylized_Violence said:

Got a friend's PC that is an HP All-In-One, roughly five years old and running Windows 8.1. Late February, a Windows Update was applied that apparently wiped out his pictures, iTunes library of ripped CDs (songs/albums/etc), and Quicken files. It also reset his wallpaper to a Windows default and upon login, a small bubble in the lower right appears telling us that a temporary profile is being used instead of his local one. He is using a Microsoft account and is the only account on the PC. No other issues were present before this Windows Update, and he reports his other files were untouched.

 

I checked the Event Viewer and saw that in late February, there was indeed an error stating that the local profile could not be loaded due to insufficient memory or because of a registry issue, and that a temp one would be used instead. No other user profiles errors were listed before then, nor up till today when I tried to diagnose his PC. After some light Googling, I found out that user profiles and data use the NTUSER.dat file, and that it might have gotten corrupted somehow. I opened the file in Notepad, and everything was mostly gibberish...except I could discern file names of the photos he used to have sprinkled throughout the file, like C://User/Pictures/wedding01.jpg and the like. Are his photos and files still present somewhere? Or they are truly gone?

 

For the record I attempted a system restore, however the last restore point is only to the beginning of this month and nothing changed. I also did verify he was signed in to his Microsoft account and superficially, it appears as if everything is working, no other error messages. Much past that, I don't know what else to do to try and retrieve his lost files. I also don't know if it truly was because of the Windows Update, I'm getting this second hand from him. He's already been warned that 8.1 is no longer supported (mainstream) but doesn't want to shell out for a whole new PC unless his files are truly lost. 

 

Any help would be appreciated, thanks!

Can do a free upgrade to windows 10 if 8.1 is installed, if it doesn't work you can get an oem key on ebay for less than $5 without having to upgrade the whole computer. I would try a file recovery program like recuva and see if it can find anything, its free, or there are paid alternatives that work just as well like EaseUS data recovery.

 

-edit: If one of those programs fail, I'd check OneDrive sometimes it likes to backup stuff there automatically even though you don't tell it to. If all that fails then more than likely the stuff is lost.

 

Oh and I just thought of one more thing, if the temp profile has administrator privileges you can navigate to C:\Users\"whatever the original profile name is" and see if anything is in there

[Guest]

22 hours ago, TwilightRavens said:

Can do a free upgrade to windows 10 if 8.1 is installed, if it doesn't work you can get an oem key on ebay for less than $5 without having to upgrade the whole computer. I would try a file recovery program like recuva and see if it can find anything, its free, or there are paid alternatives that work just as well like EaseUS data recovery.

 

-edit: If one of those programs fail, I'd check OneDrive sometimes it likes to backup stuff there automatically even though you don't tell it to. If all that fails then more than likely the stuff is lost.

 

Oh and I just thought of one more thing, if the temp profile has administrator privileges you can navigate to C:\Users\"whatever the original profile name is" and see if anything is in there

I recommended just getting a whole new PC that was designed with 10 in mind, since his is pretty old and slow even by 8.1 standards. I know the free upgrade exists, but don't feel it's the right path for him. Thanks for the suggestion though. I figured those programs to recover deleted files were only useful if someone actually deleted them; I guess I figured this was more OS related and therefore they'd be useless, but I suppose I should try anyway.

 

I checked OneDrive and he doesn't even have an account with them, so there wasn't anything there.

 

Concerning the temp profile, if I navigate to the users folder under the C:, I see his name for one folder (as expected), a Public folder, Admin folder and two folders labeled TEMPBATCOMPUTER, one of which has 000 affixed to the end. There isn't anything in those folders, they're empty. But isn't that considered weird? Could an OS update really screw him up like that?

 

Thanks for the prompt reply!

[TwilightRavens]

4 hours ago, Stylized_Violence said:

I recommended just getting a whole new PC that was designed with 10 in mind, since his is pretty old and slow even by 8.1 standards. I know the free upgrade exists, but don't feel it's the right path for him. Thanks for the suggestion though. I figured those programs to recover deleted files were only useful if someone actually deleted them; I guess I figured this was more OS related and therefore they'd be useless, but I suppose I should try anyway.

 

I checked OneDrive and he doesn't even have an account with them, so there wasn't anything there.

 

Concerning the temp profile, if I navigate to the users folder under the C:, I see his name for one folder (as expected), a Public folder, Admin folder and two folders labeled TEMPBATCOMPUTER, one of which has 000 affixed to the end. There isn't anything in those folders, they're empty. But isn't that considered weird? Could an OS update really screw him up like that?

 

Thanks for the prompt reply!

Yeah 8.1 is a strange OS, I've had it do that to a laptop that came pre-installed with it, after that happened I just downgraded it to windows 7 until it died. Its not a bad OS, it just has its quirks. But anyway yeah sometimes it can corrupt a registry setting which in the end can screw a user profile, very uncommon but it can happen in any windows version and there's not much you can do outside of recovery tools.

 

Also a recovery program might still be able to "see" the stuff in the folder even if windows says they are empty.

[Guest]

1 hour ago, TwilightRavens said:

Yeah 8.1 is a strange OS, I've had it do that to a laptop that came pre-installed with it, after that happened I just downgraded it to windows 7 until it died. Its not a bad OS, it just has its quirks. But anyway yeah sometimes it can corrupt a registry setting which in the end can screw a user profile, very uncommon but it can happen in any windows version and there's not much you can do outside of recovery tools.

 

Also a recovery program might still be able to "see" the stuff in the folder even if windows says they are empty.

Well I guess I'll give it a whirl, thanks.

[Guest]

Files were not detected, so I guess his files are gone for good. Still not sure what happened but can't do anything about it.

 

Marking solved.