Urgent advice required

mewso

Hi,

I just got a call from a very distraught sister. All her word and powerpoint documents are gone (a years worth). Apparently there are files of the same name but they are shortcuts that don't link to anything. Has anyone ever heard of this? Is it possible that her files somehow got renamed to .lnk files? Is there a virus that does this sort of thing?
I've been searching on the net for anything of a similar nature to no avail so I'm just wondering if anyone has any ideas as I'll be having a look at her pc (it's a laptop) tomorrow. Thanks.

sceptre

Just the obvious:

Check the recycle bin and do a proper *.doc etc search - may be possible she (or someone else) moved them somewhere.

Check the size of the lnk files - it may be possible that the .lnk suffix has been added to the end and that the files are still there

mewso

Yeah I'll be checking all of those things thanks. I'm still waiting for her to call in so I can have a look at it. The info. I got soem more details from her:-
She is using WinME on a Dell Laptop
The last thing she remembers doing before noticing her files were gone and replaced by shortcuts to nothing was uninstalling Yahoo Messenger.
I was out when she rang first so she rang microsoft (this is when I shuddered).
The microsoft guy told her to search for the files and they didn't appear in a search.
He then got her to do a system restore.
With the files still missing he told her that was all she could do - the files were gone and could not be retrieved.
With a years work gone and a presentation due in a few days this is when she paniced. Thank you Microsoft.
I'm worried the system restore might cause problems if I have to use an undelete program but I don't know how it would affect things.
I'm still pinning my hopes on the shortcuts being the actual documents renamed but it's a slim hope. Any help or ideas would be appreciated.

Pigman

Lnk files are literally just shortcut files that show the path to where the *.doc should be. Even though they have the same name and almost the same icons as your missing files it's unlikely that the docs/ppt files were somehow changed to lnk files - tho if they were you could retrieve them by simply changing the file extention from lnk to doc, ppt etc. Try changing one to see if this is the case. You can always change it back.

Another thing you could do is look for *.tmp files all through your computer that coorespond with the timeframe where the files in question were lost. Remane them to doc and you might get lucky.

Mr E

Stupid question - did your sister try double clicking on the shortcut? Do any of them open the original docs?

- Dave.

ando

any anti-virus software on the machine ?

do a search on the c:\ drive for the name of the file, with no .doc at the end (eg, 'reports' and not 'reports.doc'

*me suspects the nature of winME*

Drazhar

one thing bothers me, the microsoft guy told your sister to restore the system, but doesnt that only restore the system settings to a previously stable state, not files/documents and things??
Weird problem, cant think of anything more to help than has been mentioned

mewso

Thanks for the help guys. I looked at the shortcuts and I discovered that she had slightly misinformed me. She had found the shortcuts in a search but these were just in a recent folder and pointed to her my documents folder where everything had dissappeared.
I downloaded an undelete program for her and last I heard she was successfully recovering them. It still remains a mystery as to how they were deleted but I have told her to get Norton Anti-Virus or something to properly scan her PC.
As for the Microsoft guy (in England he was) he should be shot for what he told her. She even said to him she had heard there were programs that could recover deleted files and he said no if they didn't turn up in a search then they were gone for good. Idiot.

sceptre

Nice one, all happy. Poor service ffrom the MS chap though, both for what you've said and the point that Drazhar correctly mentioned.

ando

Their not exactly going to say on the phone to you, oh yeah btw, our product is not the best for security, if you delete some files, they can be recovered. Imagine if it was a solisitor or a TD.. wanting to delete some backhander documents from eircon ... microsoft aint going to exactly say to that corrupt TD, 'oh btw, if you delete some of these documents, they CAN be recovered' !!!

I think he knew very well what kind of advice he was giving

Drazhar

Kinda makes you think, did that tech support just read a line or two from the BOFH, then try to adapt it to windows