none
Profile NTUSER.DAT what's in a name? RRS feed

  • Question

  • What's in a name?

    Master of Science ComputerEngineer/Wintel since 1985, trouble-shooting first time in which i have participated in customer loss of data. 09 Toshiba Satellite w7-32 HomePremium customer stored data in profile Documents. We reviewed file structure including the payload subdir from the Users directory in which only 1 profile occurs and copied the nameFolder from the profile to clean, formatted 2G flashDrive. I then copied the singleFolderTree into a subdirectory under myDocuments. This is the first time i have put anything of value into my (XP) profile tree; simply hoping to enjoy efficiency of subsequent access to customer tree in which i was adding diagnostic/forensic docs compiled to troubleShoot customer chief Complaint: Windows7 Firewall is not on and cannot be turned On. This, apparently subsequent to change of ownership by cableCompanyISP.

    We apparently did not open and review the copied Tree, satisfied we had normally copied the important Tree with valued data.

    In fact, after w7 re-Install on deleted/reCreated drive partition on customers Notebook, we then found on the flashMaster and all copies of said ProfileTree no user folders underneath the Profile-named parent folder;.only an Apps folder -- intact, with Adobe subdirs, etc -- and 3 series of triplets:

    64M: NTUSER.DAT{<36charSSID(GUID)>}.TM.blf

    and

    512M nearly identical filenames with same prefix but extended suffix:such that .blf is replaced by

    Container00000000000000000001.regtrans-ms

    and then

    Container00000000000000000002.regtrans-ms

    The first triplet is dated likely when the initial profile was created in 2009.

    Following triplets feature lowerCase ntuser.dat.

    The second triplet, identical except for different GUID, is dated 9 months later in 2010.

    The third triplet, again identical but again different GUID, is dated 2013 late June when she first encounted the McAfee popUp warning of no Firewall while efforts on McAfee windows were dysfunctional otherwise.

    After extensive research, on this site, of the dysfunctionality involving "Windows Firewall Authorization" which showed as "working properly" in the customer's DeviceMgr, and failing to take ownership of residual McAfee executables, i concluded the best cure was re-install, which result is fine; but valuable data remains unavailable.

    My practice and advice to customers has always been to never store anything in the profileTree. This first time i slipped, i am burned; otherwise i have never been part of customer loss of data.

    Any advice?

    I note the new profile on the reInstall exactly matches the first triplet on the old, 4yearsPrior, including exact 36-char GUID.

    Thank you, sincerely, john

    Thursday, July 11, 2013 5:50 AM

Answers

  • Most likely the user profile is corrupted.

    try deleting the old profile and re-login onto the same machine with the same user login ID.

    profile will automatically be re-created. But before deleting any profile please back up the content using an alternative administrator account to back up the data.


    Guowen Su
    Cisco Certified Network Associate
    Cisco Certified Internetwork professional - MPLS
    Certified Information Systems Security Professional
    Microsoft Partner Network 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator:Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator
    Certified Ethical Hacker
    Computer Hacking Forensics Investigator
    Certified Sonicwall Security Administrator
    Microsoft Geeks

    • Proposed as answer by Soh.M Thursday, July 18, 2013 3:45 AM
    • Marked as answer by Soh.M Thursday, October 3, 2013 6:38 AM
    • Unmarked as answer by forAbetterWorld Thursday, October 3, 2013 3:45 PM
    • Marked as answer by Soh.M Monday, October 7, 2013 3:09 PM
    Thursday, July 18, 2013 3:45 AM
  • Hey,

    There are chances but it will cost you alot of money.

    There is a company CBL data recovery company. They provide data extraction and data integrity fixing.. If you wish to give a shot. I got contacts with me :) i wouldnt mind sharing with you.

    http://www.cbltech.com.sg/

    let me know :)


    Guowen Su
    Cisco Certified Network Associate
    Cisco Certified Internetwork professional - MPLS
    Certified Information Systems Security Professional
    Microsoft Partner Network 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator:Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator
    Certified Ethical Hacker
    Computer Hacking Forensics Investigator
    Certified Sonicwall Security Administrator
    Microsoft Geeks


    • Edited by Soh.M Thursday, October 3, 2013 4:02 PM add html
    • Marked as answer by Soh.M Thursday, October 3, 2013 4:03 PM
    Thursday, October 3, 2013 4:00 PM

All replies

  • Most likely the user profile is corrupted.

    try deleting the old profile and re-login onto the same machine with the same user login ID.

    profile will automatically be re-created. But before deleting any profile please back up the content using an alternative administrator account to back up the data.


    Guowen Su
    Cisco Certified Network Associate
    Cisco Certified Internetwork professional - MPLS
    Certified Information Systems Security Professional
    Microsoft Partner Network 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator:Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator
    Certified Ethical Hacker
    Computer Hacking Forensics Investigator
    Certified Sonicwall Security Administrator
    Microsoft Geeks

    • Proposed as answer by Soh.M Thursday, July 18, 2013 3:45 AM
    • Marked as answer by Soh.M Thursday, October 3, 2013 6:38 AM
    • Unmarked as answer by forAbetterWorld Thursday, October 3, 2013 3:45 PM
    • Marked as answer by Soh.M Monday, October 7, 2013 3:09 PM
    Thursday, July 18, 2013 3:45 AM
  • obviously the profile was corrupted.

    1.  why?

    2.  is there no method of recovering original data after corruption?

    Not expecting solution for either, but thanks for interest.


    john

    Thursday, October 3, 2013 3:56 PM
  • Hey,

    There are chances but it will cost you alot of money.

    There is a company CBL data recovery company. They provide data extraction and data integrity fixing.. If you wish to give a shot. I got contacts with me :) i wouldnt mind sharing with you.

    http://www.cbltech.com.sg/

    let me know :)


    Guowen Su
    Cisco Certified Network Associate
    Cisco Certified Internetwork professional - MPLS
    Certified Information Systems Security Professional
    Microsoft Partner Network 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator:Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator
    Certified Ethical Hacker
    Computer Hacking Forensics Investigator
    Certified Sonicwall Security Administrator
    Microsoft Geeks


    • Edited by Soh.M Thursday, October 3, 2013 4:02 PM add html
    • Marked as answer by Soh.M Thursday, October 3, 2013 4:03 PM
    Thursday, October 3, 2013 4:00 PM