recover deleted chat log? - Printable Version
-Shoutbox (https://shoutbox.menthix.net)
+-- Forum: MsgHelp Archive (/forumdisplay.php?fid=58)
+--- Forum: Messenger Plus! for Live Messenger (/forumdisplay.php?fid=4)
+---- Forum: WLM Plus! Help (/forumdisplay.php?fid=12)
+----- Thread: recover deleted chat log? (/showthread.php?tid=59640)
recover deleted chat log? by mrchampipi on 05-22-2006 at 01:11 PM
Hey there,
I'm struggling for hours trying to get some deleted msn chat logs back on my drive, using tune-up utility "undelete" function. Those logs are not encrypted and have been accidently deleted pretty recently, so tune-up should easily be able to get them back...
But out of the 1000s of deleted files, there don't seem to be a single trace of my msn chat logs 
So here's my request: what should I be looking for to find those log files ( .what? or any other way)
Help would be greatly apreciated, some of those deleted logs have crutial importance to me.
thx in advance,
mrchampipi
RE: recover deleted chat log? by andrewdodd13 on 05-22-2006 at 01:38 PM
You're looking for .txt (or .xml if they are the default MSNM chat logs).
If it's the Plus! chat logs you could also use a *@*.txt search pattern, which will restrict the search results to only include email addresses. (Or other files with that format, which there may be a few of).
Also, if you installed the undelete utility after deleting the files it may have been written to the same location as the deleted files... meaning they'll be practically unrecoverable.
RE: recover deleted chat log? by RaceProUK on 05-22-2006 at 03:34 PM
If it's a FAT32 file system, nothing is unrecoverable, unless the areas of the disk are written over many hundreds of times. However, recovering data this way requires some highly expert knowledge: a quigk Google should reveal just how much work it is.
RE: RE: recover deleted chat log? by CookieRevised on 05-22-2006 at 04:04 PM
quote:It doesn't matter what file system it is.
Originally posted by raceprouk
If it's a FAT32 file system, nothing is unrecoverable, unless the areas of the disk are written over many hundreds of times. However, recovering data this way requires some highly expert knowledge: a quigk Google should reveal just how much work it is.
Also, when the sectors, where the files were in, are overwritten (it only takes 1 time overwriting, not many times) the files are lost. period.
And the longer you wait to "recover" accidently erased files, the more chances are that the files are overwritten already. Also, the fuller your harddisk is the more chances are that the files are already overwritten. Also, the more times you boot up with that same partition where your files were in, the more chances the files are overwritten... etc.
mrchampipi, if you want to decently recover deleted files, you _must not_ boot up with that partition anymore! You also _must not_ even use that partition anymore (this means do not open programs etc on it) until you have succesfully recovered the deleted files.
All this because each action you do (even extremely small) will further decrease the possebility for succesfull recovery.
To search for Messenger XML logs you could search for various tags from an Messenger XML log. Open a still existing XML log and look for various tags, then search for them on the hard disk you try to recover files from.
--
What raceprouk might speak of is something only police and other highly trained and professional forensic institues _may_ be able to do. This is way, waaaaaaaaaaaay, beyond what normal (or even advanced) computer users will ever be able to do.
See "CookieRevised's reply to Full erase" for more information about this.
RE: recover deleted chat log? by RaceProUK on 05-22-2006 at 08:38 PM
quote:That's what I was talking about.
Originally posted by CookieRevised
What raceprouk might speak of is something only police and other highly trained and professional forensic institues _may_ be able to do. This is way, waaaaaaaaaaaay, beyond what normal (or even advanced) computer users will ever be able to do.