Windows 10 - disappeared files

[Midsmartin]

They are several bits of software you can get for free that might recover files. If one doesn't work sometimes another does.

If you think the files might have been deleted, then never boot the suspect computer. Always remove the drive to check from another computer, as any activity might overwrite the deleted files.

Check if the laptop has made a temporary user profile folder for some reason in c:\users, and the missing files are just in another profile

There was a windows update once that lost files. I forget the details but they got left in a temporary folder by the update process and so a thorough search with admin rights would find them.

[GoSeigen]

I've had a chance to look at this again more closely.

At the modification time (to the nearest minute) of the directories with missing files, two things happened:
-Lenovo Vantage Service was running immediately prior, it updated files in its c:\ProgramData\...\SystemAddins directory
-Google Chrome displayed a Facebook page.

The first is suppose is a background task and would surely not touch a user directory and certainly not alter it in the way we have found, right?
The second is what the employee was supposed to be doing on the PC at that moment.


So the question is: did he also deliberately do something to copy or move the directory (and contents) immediately before using the browser, or did something else happen? Aside from the modification date and time, would any other trace have been left of a copy or move?

I'm still trying to get to the bottom of this for three reasons: 1. if the files were copied to some other media they may still be recoverable and 2. if it was a deliberate sabotage or attempt to take copies of the files then that would be a disciplinary issue with this particular staff member and have implications for security of the business. 3. Don't want to keep losing files!!

So if anyone has any ideas...



Other info:
-Restoration of our internet connection had no effect on the missing files.
-When I logged into OneDrive via a browser there was basically nothing there.


GS

[GoSeigen]

After a quick Google Search I've found this forum discussion which suggests that it is common for users to find that Windows 10 has deleted their files! Is that true? If so I really can't believe what I have been missing out on using Mac OS all these years!

One user's comments looked exactly like our scenario:

But after 3 days I found all files were gone. I cannot find the files anywhere. There are only several short cuts that are not accessible and several temporary files that are not accessible either. I have no idea where to find and recover several giga bytes of files which I collected for last 10 years!!!

Keeping user data is the very basic requirements in any OS upgrades. Why Windows 10 upgrade move and remove user data without users' knowledge??????????
[my bold]


OMG. Time to go and do another reccy...


GS

[Infrasonic]

Have you not got backups you can restore?

Windows has File History as a native option but it isn't switched on by default.

Many on here use Macrium Reflect which will do OS/apps/Files. I've got the paid option so I can do the OS and files as separate automated backup schedules - files more frequently than OS.

Syncthing is another third party file sync option that be set up to store offline copies on all/some client devices. Popular with IT pros.

I'd strongly suggest you get a business grade NAS like a Synology + series. They will do snapshots/backups with immutable (read only) copy options, scheduled local and cloud backups et al.

https://www.tenforums.com/tutorials/id-Backup_Restore/

https://syncthing.net/

https://www.youtube.com/@nascompares/videos

[Urbandreamer]

After a quick Google Search I've found this forum discussion which suggests that it is common for users to find that Windows 10 has deleted their files! Is that true? If so I really can't believe what I have been missing out on using Mac OS all these years!

One user's comments looked exactly like our scenario:

But after 3 days I found all files were gone. I cannot find the files anywhere. There are only several short cuts that are not accessible and several temporary files that are not accessible either. I have no idea where to find and recover several giga bytes of files which I collected for last 10 years!!!

Keeping user data is the very basic requirements in any OS upgrades. Why Windows 10 upgrade move and remove user data without users' knowledge??????????
[my bold]


OMG. Time to go and do another reccy...


GS

I think that I commented about this earlier in the thread.
viewtopic.php?p=636312#p636312

Basically don't trust the standard directories that Microsoft uses. Create a backup policy and automate it. Preferably a backup policy that maintains changes, rather than overwriting historic data with the current stuff.

I did a quick web search and this link may be of help.
https://caughtinpixels.com/how-to-creat ... -robocopy/

[Lanark]

All files and subdirectories are missing except temporary files and directories which contain temporary files (names prefixed with a ~).

OneDrive will always leave temporary files (prefixed with ~ ) alone, so that indicates everything may have been sucked up into a cloud account and then deleted when the user logged out of OneDrive.

One thing I urge people is do not install OneDrive on a machine unless you understand what it does and how to configure it properly.

[Infrasonic]

For a business with employees you should be using business tier OneDrive with admin capabilities so that settings can't be accidentally/maliciously altered by a non admin user, and the admin accounts should have robust multi factor authorisation in place like hardware FIDO2 keys (e.g Yubikeys) for Windows and any associated apps and services - there' s too many zero day hacking issues floating around in addition to the numpty employee possibilities.

I'm getting about 30 malicious log in attempts a day on my main MS account, all unsuccessful because everything is 2FA access / allow listed devices only so even with a cracked password they still can't get in.

https://www.yubico.com/works-with-yubik ... rt=popular

[mc2fool]

-When I logged into OneDrive via a browser there was basically nothing there.

I don't use and so am not that familiar with OneDrive but did you look in its recycle bin? Maybe someone who is familiar can advise on that. I do believe that OneDrive keeps any deleted/overwritten files for 30 days, although of course that does assume it had them in the first place...

[GoSeigen]

OneDrive will always leave temporary files (prefixed with ~ ) alone, so that indicates everything may have been sucked up into a cloud account and then deleted when the user logged out of OneDrive.

How do I check whether OneDrive is enabled or not? A quick search through the Control Panel area didn't reveal anything.

Even if OneDrive were enabled it seems strange that just one user directory out of several on the desktop should be affected. No-one would have selected it alone to be in OneDrive.

I can't think of any reason that particular directory should have been targeted anyway, for that matter -- it is similarly named vs the others, it has similar content and was in the same location in the directory structure. It did have "Office Manager" in the name -- I hope this didn't confuse Microsoft and cause it to be cleaned up along with other Office files!

GS

[Infrasonic]

https://www.tenforums.com/tutorials/197 ... index.html

There's a load of W10 OneDrive tutorials here, scroll down to O.

[Infrasonic]

https://www.easeus.com/datarecoverywiza ... ftware.htm

Recover up to 2GB data for free on Windows 11/10/8/7

Did you look into what specific file was written before the OD issue in Lenovo Vantage?

By default Vantage will (or used to) update the PC firmware (BIOS) and drivers automatically unless you turn it off in settings (mine's off).
There's critical and optional update toggle switches for auto updating.

If the PC is still within it's support window you can have Vantage start at boot and look for updates without auto updating - a safer option.
As mine is out of support I have turned it off in start up as well and run it manually now and again.
When Vantage itself updates it will sometimes overwrite those user settings and go back to the auto start and update defaults...

I've had issues in the past with these kind of OEM system apps breaking things so I always switch off any auto updating - I just get an alert that an update is available - if it's deemed critical (i.e. zero day) I'll do a Google search first to see if there any issues with it before patching.

Have you run a W10 admin command line prompt sfc/scannow to see if it throws up any file corruption issues - it will auto fix and generate a CBS log file that you can analyse to see what it specifically fixed. I have mine as a shortcut on my desktop... C:\Windows\Logs\CBS\CBS.log
On older Windows installs it's worth running on a semi regular basis (weekly for me on a 9 year old Lenovo W10 PC) just to keep the OS reasonably clean.

Running an MCT copy of W10 in repair/upgrade mode can also clean up the registry - as there's no more feature updates now with W10 whatever is currently on the Microsoft servers will be up to date sans newer security / optional updates.
https://www.tenforums.com/tutorials/163 ... grade.html