What you're looking for, is a "book on forensics".W. eWatson said:I've lost a file with the word pressure in the name. It and a wbk file
are not found in a search. I had them Friday the 11th. I looked in
recycle, used a file name search, and a content search. I come with some
old files that are way out of date. I do have a print out of the data
from the 11th, two pages of tables, which I'm not excited about
re-entering the information.
I do back up files with Win7 Backup, but am not familiar with finding
back ups there. My PC has been working just fine for more than a week.
1) File may exist, but put in the wrong directory.
Note that if you attempt to write a file to an illegal location,
Windows 7 has a "special place" to store the file, giving the
appearance the attempt worked. They did that, for backward
2) File could have been deleted. Files are not really deleted until
they are overwritten. An undelete utility or a file scavenger,
could find the file. But that only works, if you *stop* writing
to the disk, before it is too late. If you continue to allow writes
to the disk partition, eventually the deleted file will be overwritten
and then it will not be recoverable. Slaving the Win7 disk to a
WinXP machine (where you've turned off System Restore completely in
advance), might allow you to work on it.
An example of a scavenger is Photorec. I did a trivial test case, and
this actually found the file.
3) If the file system was damaged, like a whole directory went missing,
then you'd need something better than chkdsk to work on the problem.
There are a gazillion utilities out there. For your situation, I might
use a copy of Sysinternals "contig.exe" from 2006 or 2008. The latest
version broke the file listing capability. If you do something like
contig -v -a -t C: > output.txt then the entire C: partition
is listed, all files and directories. You'd need to run with admin (elevated)
to get a complete listing. The contents of System Volume Information will
not be shown (Access Denied).
Another utility, is "nfi.exe", which is an NTFS specific tool which lists
every file, and shows which sectors the files are stored on. Again, System
Volume Information is "Access Denied".
Of the two, it'll take a couple more minutes to find a copy of nfi.exe
than to find contig. But in the case of contig, you cannot use
the version currently on the web site. As it will no longer list the
entire partition. But the old versions do.
Once you have a text file with a listing of the entire disk, then it
should only be a couple minutes work to find the file. (As long as it
hasn't been deleted!)