locked
data recovery after system restore and corrupt user account. RRS feed

  • Question

  • A few months ago I was in the middle of a school assignment and my HP laptop started acting strange. I would try to move an image and a copy of it would remain in its place. I couldn't delete the picture either, but I could "cut" the image. Well, I ended up restarting the computer and when I logged on it logged me into a temporary account because my account failed to log on. Not knowing exactly what was going on or what to do we ended up doing a system restore like a dummy and restarted the computer. Well, when I logged back in everything was gone, all my school stuff was gone. What do I do can I get these back without having to pay a lot of money to do so? I am a single mother of two and there is no way I can afford anything.
    Monday, November 22, 2010 7:14 PM

Answers

  • Hi,

    Thanks for posting!

    If your school stuff is saved on local hard driver, system restore won't remove them. They must be somewhere. There are only certain settings and configurations changes.

    A temporary profile is issued each time that an error condition prevents the user's profile from loading. Temporary profiles are deleted at the end of each session, and changes made by the user to desktop settings and files are lost when the user logs off.

    A user profile consists of the following elements:

    1.A registry hive. The registry hive is the file NTuser.dat. The hive is loaded by the system at user logon, and it is mapped to the HKEY_CURRENT_USER registry key. The user's registry hive maintains the user's registry-based preferences and configuration.
    2.A set of profile folders stored in the file system. User-profile files are stored in the Profiles directory, on a folder per-user basis. The user-profile folder is a container for applications and other system components to populate with sub-folders, and per-user data such as documents and configuration files. Windows Explorer uses the user-profile folders extensively for such items as the user's Desktop, Start Menu and My Documents folder.

    We can perform the following method to resolve such issue:

    1. Restart your PC to release the locks on your profile.
    2. Log on with another administrative account
    3. Delete C:\Users\%username%
    4. Delete C:\Users\TEMP
    5. Delete the registry key matching your SID from
    "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\ProfileList". Check the value "ProfileImagePath" to make sure you pick your own profile.

    6. Restart once again.

    Good Luck.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    Friday, November 26, 2010 9:19 AM
    Moderator

All replies

  • Hi,

    Thanks for posting!

    If your school stuff is saved on local hard driver, system restore won't remove them. They must be somewhere. There are only certain settings and configurations changes.

    A temporary profile is issued each time that an error condition prevents the user's profile from loading. Temporary profiles are deleted at the end of each session, and changes made by the user to desktop settings and files are lost when the user logs off.

    A user profile consists of the following elements:

    1.A registry hive. The registry hive is the file NTuser.dat. The hive is loaded by the system at user logon, and it is mapped to the HKEY_CURRENT_USER registry key. The user's registry hive maintains the user's registry-based preferences and configuration.
    2.A set of profile folders stored in the file system. User-profile files are stored in the Profiles directory, on a folder per-user basis. The user-profile folder is a container for applications and other system components to populate with sub-folders, and per-user data such as documents and configuration files. Windows Explorer uses the user-profile folders extensively for such items as the user's Desktop, Start Menu and My Documents folder.

    We can perform the following method to resolve such issue:

    1. Restart your PC to release the locks on your profile.
    2. Log on with another administrative account
    3. Delete C:\Users\%username%
    4. Delete C:\Users\TEMP
    5. Delete the registry key matching your SID from
    "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\ProfileList". Check the value "ProfileImagePath" to make sure you pick your own profile.

    6. Restart once again.

    Good Luck.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    Friday, November 26, 2010 9:19 AM
    Moderator
  • Performing a system restore will erase all of your personal files.But they are not gone for good and you can recover them with data recovery software.Only if your files are written over by new ones,they are gone for good.
    I used Tenorshare Data Recovery and it worked.Anyway,you can download it and scan your hard drive for free to preview whether your files can be recovered.It will show you the file name,type,date and size of your files and thumbnails for your pictures that it found on your drive.
    Get it from http://www.any-data-recovery.com/product/datarecoverystandard.htm
    Thursday, November 17, 2011 3:26 AM
  • Typical engineer response.  With all due respect, you have terrible communication skills.

    Your response was to a single mother of two, who doesn't have two weeks of vacation time to spend learning all of your acronymns and editing the registry.

    See Edward Malotte's response below for a real solution.  He clearly understands he is talking to a human being who needs real help, and has offered a simple solution, that assesses her problem for free, and addresses her needs.

    Get a clue Ms. Liu and microsoft support. 



    • Edited by mcamp123 Saturday, March 3, 2012 7:28 AM
    Saturday, March 3, 2012 7:16 AM
  • I'm assuming that, since this post is 2 years old, rachbutterfly81 has already moved on with her life. But, since this is the second time I've run into this problem, and this is the first time I've found a solution that worked, I thought I would add my two cents. Of course I do agree that the original response was a little heavy for a mother of two, but it did work for me (with some slight variation that I will get to).

    I definitely disagree with Mr. Malotte's statement that all her files were deleted by the system restore. She was obviously logged in under a temporary account, and so all her original files were fine and stored under the same location they always were. There was no need for her to purchase additional software to "recover" her files when they were all there under her original account name. All she would have had to do to find her files (assuming she was running Windows Vista or 7) was to open her "C:" drive and navigate to the "C:\Users\" directory and look for the folder with her account name.

    Anyway, the first solution worked for me, BUT there is absolutely no reason to delete the original account folder as Magon suggests in step 3! Simply rename it. Once you finish step 5 and delete the original registry key (I recommend backing it up by right clicking on the key and selecting export), there is no reason to reboot your machine. There are some additional steps to make life a little easier though. I've added them to a modified version of the original:

    1. If you know you have another administrative account you can use, go ahead and restart your PC to release the locks on your profile. If you don't have another account to use, you can create one by going to "Add or remove user accounts" in the control panel. Select "Create a new account," name it whatever you want, check the Administrator box, and click "Create Account" (you may want to consider adding a password to this account as well). Now you can restart.
    2. Log on with another administrative account
    3. Rename your original profile to something different. For the sake of simplicity, we'll pretend it was called "myaccount." So, you would rename "C:\Users\myaccount" to "C:\Users\myaccount.original." It really doesn't matter what you name it, so long as it is different than it was and you can still find it again.
    4. Delete C:\Users\TEMP
    5. Delete the registry key matching your SID from
    "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\ProfileList". Check the value "ProfileImagePath" to make sure you pick your own profile.

    6. Log off and then log into your original account. Everything will still look messed up, like before, but it will not warn you that you are logged in under a temporary account.

    7.While logged in, navigate to your user directory (not C:\Users\myaccount.original, but the current one you are logged in under, C:\Users\myaccount) and copy any files you see that say "ntuser" in them into your original profile directory (C:\Users\myaccount.original). Most likely, you won't be able to see any, so you will need show hidden files. Hit Alt on your keyboard, and you should see the menu bar appear. Select "Tools" and then "Folder Options". Select the "View" tab, and under "Hidden files and folders" check the option to "Show hidden files, folders, and drives." While you are at it, uncheck the box next to "Hide protected operating system files."

    8.Once you've copied the files over, go ahead and log out. You will need to log into your other administrative account once more.

    9.Rename the new account (or delete it if you want), and rename your original account back to what it was (so "C\Users\myaccount.original" will be renamed to "C:\Users\myaccount").

    10. Log out and now log in using your original account. Some things may not work as they originally did (for instance, I had to log into dropbox again and go through the setup process), but most things will. Most importantly, all your files should still be there.

    • Proposed as answer by randoogle Sunday, June 24, 2012 4:03 AM
    Sunday, June 24, 2012 4:00 AM
  • so all of the accounts named 'TEMP' and are replicated also the actual account of the user, replicated too. should be deleted and be left with the atual profile and the other that maybe in it the desktop files is hidden, somehow? also, about these few 'TEMP' profiles, they get generated every time the computer logs you in temporarily?
    Wednesday, October 8, 2014 7:58 AM