User Profile lost - How to recover some files?

highnote606

Honorable
Aug 27, 2013
4
0
10,510
Hi all

We have nine clients connected to a small server. Clients use Windows XP Pro. Recently there was malware on one of them. So we ran a program to clean it off successfully. I don't know if its a coincidence or what. But soon afterwards, when logging out of the domain and back on, we noticed "Loading personalized settings..." stayed on for about 5 minutes. Once the desktop showed up, it was like looking at a new profile. Programs were still on there. Its just that the user's profile settings had vanished. I went into Documents and Settings and could not find the folder.

I did not try using System Restore to possibly restore back to the right profile, as I don't know if its actually works that way. We never had to use it. And there seems to be a gray area in what it changes. We do have some important files on there. No one bothered doing backups to the server. And that is an intention of mine. But beside the point.

What we did was just try setting the configuration back up the way it was (the long way). But still, there are some important things missing. The primary thing being the OST file for Outlook. We use Shoretel Communicator for our phones, and it includes an Outlook connector. The user lost over a year's worth of emails and contacts. A big tragedy since nobody bothered to back them up. I ran GetDataBack to see if I could recover it. It did not find it anywhere which surprises me. Where could it have gone to? A file that is simply deleted or overwritten with a much smaller sized file would at least be seen by a recovery program. In this case it was not. Is there any chance that the outlook files might have been setting in a profile folder on the server and then got wiped out because of a profile breakage on the local end?
 

highnote606

Honorable
Aug 27, 2013
4
0
10,510
I did. But there isn't any sign of the files having been quarantined or deleted by the malware program. Strangely. One thing I was able to see is a change in the local user properties in Administrative Tools. Under "Member of" tab. It normally lists the DOMAIN.user. But that isn't there. But it is certainly there on other clients. This is why I am thinking something happen to break the client server relationship on this PC. But do not understand why this might affect important local data. Or was the data even local?