Shoutbox

Hey there,

I'm struggling for hours trying to get some deleted msn chat logs back on my drive, using tune-up utility "undelete" function. Those logs are not encrypted and have been accidently deleted pretty recently, so tune-up should easily be able to get them back...
But out of the 1000s of deleted files, there don't seem to be a single trace of my msn chat logs So here's my request: what should I be looking for to find those log files ( .what? or any other way)

Help would be greatly apreciated, some of those deleted logs have crutial importance to me.
thx in advance,

mrchampipi

You're looking for .txt (or .xml if they are the default MSNM chat logs).

If it's the Plus! chat logs you could also use a *@*.txt search pattern, which will restrict the search results to only include email addresses. (Or other files with that format, which there may be a few of).

Also, if you installed the undelete utility after deleting the files it may have been written to the same location as the deleted files... meaning they'll be practically unrecoverable.

If it's a FAT32 file system, nothing is unrecoverable, unless the areas of the disk are written over many hundreds of times. However, recovering data this way requires some highly expert knowledge: a quigk Google should reveal just how much work it is.

quote:

---

Originally posted by raceprouk
If it's a FAT32 file system, nothing is unrecoverable, unless the areas of the disk are written over many hundreds of times. However, recovering data this way requires some highly expert knowledge: a quigk Google should reveal just how much work it is.

---

It doesn't matter what file system it is.

Also, when the sectors, where the files were in, are overwritten (it only takes 1 time overwriting, not many times) the files are lost. period.

And the longer you wait to "recover" accidently erased files, the more chances are that the files are overwritten already. Also, the fuller your harddisk is the more chances are that the files are already overwritten. Also, the more times you boot up with that same partition where your files were in, the more chances the files are overwritten... etc.

mrchampipi, if you want to decently recover deleted files, you _must not_  boot up with that partition anymore! You also _must not_ even use that partition anymore (this means do not open programs etc on it) until you have succesfully recovered the deleted files.

All this because each action you do (even extremely small) will further decrease the possebility for succesfull recovery.

To search for Messenger XML logs you could search for various tags from an Messenger XML log. Open a still existing XML log and look for various tags, then search for them on the hard disk you try to recover files from.

--


What raceprouk might speak of is something only police and other highly trained and professional forensic institues _may_ be able to do. This is way, waaaaaaaaaaaay, beyond what normal (or even advanced) computer users will ever be able to do.

See "CookieRevised's reply to Full erase" for more information about this.

quote:

---

Originally posted by CookieRevised
What raceprouk might speak of is something only police and other highly trained and professional forensic institues _may_ be able to do. This is way, waaaaaaaaaaaay, beyond what normal (or even advanced) computer users will ever be able to do.

---

That's what I was talking about.