Windows 7 Win7 Auto-restart Trashed my MS Word File

[Slimfinger]

I had an MS Word 2007 file on my system. I had it opened for a couple days, and during this time, Windows decided to FORCE a restart of my system (beautiful idea to default to this behavior, btw), and while doing so completely lost (how?) my saved copy of the aforementioned file.
This file is quite important to me, and I have tried to recover it by many different means thus far, to no avail. Included:
1) Use of at least six different "data recovery" applications. No luck.
2) Followed instructions of every single "recover lost word files" URL on the internet. No luck.
3) Searched raw disk data for recognizable text. No luck.
4) Repaired target HDD via CHKDSK in hopes of recovery of lost data and/or file handles. No luck.
5) Etc., etc., etc.
Here is some miscellaneous info:
a) The temporary hidden file MS Word creates upon opening a document (prefixed with "~$") remains. This is proof that this file was in fact saved before the disastrous decision by MS to reboot my system without my consent. However, this file merely contains user data.
b) I had previously modified and saved the text of this file several times over several days, as well as copy/pasted it a few times just previous to the loss of data. The hard drive where it resided was 500GB in size. The text (or at least segments of it) is likely to still exist somewhere on this disk. During my fruitless searches for lost files using 3rd party applications, I encountered nearly everything I've ever written on that drive in the past two years, and in particular a group of items that I wrote at around the same time. This is another reason to suspect that significant amounts of the lost data I'm looking for are likely to be on the disk somewhere.
c) Given that none of the 3rd party apps could find any part of the file in question, and in light of whatever EXACTLY occurred during the forced restart that would result in a saved file being dropped simply because it was open at the time of shutdown, it might be safe to say that I will not find it via any search (no matter how exhaustive) that relies upon the file system itself. However, given that MS Word encodes and encrypts documents by default it is not a simple matter to find the data via a scan of the drive for raw data (what do you search for?).
*** SO, IN SUMMARY ***
I am somewhat confident that at least some of the missing data is in fact on this disk. Given the facts above, I am at an impasse as to how I might retrieve any of it. Any advanced advice or suggestionsto help resolve this episode (and/or explain exactly what likely occurred) would be greatly appreciated!
NOTE: please do not ask irrelevant questions - e.g., "why was the file not backed up?"

 

[jcgriff2]

Hi -

My only suggestion at this time is to try the WHERE command.
[COLOR=#7777777]START | type cmd.exe | RIGHT-click on cmd.exe | "Run as Administrator" | type/ paste the following -[/COLOR]

[FONT=Lucida Console]where /r c:\ /f /t *.doc* > 0 & start notepad 0 [/FONT]

It may take a few minutes to run.

A Notepad will open with the results.

Good luck to you.

Regards. . .

jcgriff2

 

[patcooke]

Another possibility would be to use a hex editor to search the disk at sector level for known text strings. It may well result in finding the file by a number of bits and pieces if it was large and fragmented and will not help much for any non-text content but it should help you rebuild the majority, if not all of your text. (And I'm pleased to note you have observed for yourself that a backup would have helped so as requested - I'm saying nothing!).

 

[Saltgrass]

I agree the question about "how could this happen" is appropriate in this circumstance.

Windows will normally give you a warning your system is about to be rebooted. If you did not see such a warning, could the system have rebooted for some other reason? Did you see a message about closing open programs just before the reboot?

You say you had copied and pasted the file somewhere prior to the reboot. Those copies are gone? Nothing should have happened to erase those.

Did you have the file in a .doc or .docx format? Have you enabled the viewing of hidden and possibly system files during your search for the file?

Is it listed in the recent files in Word?

Had you done any system backups during this time?

Have you tried a System Restore? I suppose you would not want to do this if you did not have a restore point after creation of the file.

I will probably get in trouble by asking the above questions, but I have no way of knowing what you might consider an "Irrelevant" question, so I will apologize ahead of time.

 

[Slimfinger]

jcgriff - is there something I'm missing, or isn't that just a simple OS command that will look for files by name? Is there some way that this command will actually search outside of the file system or look for arbitrary data within the file? I think that maybe you haven't read my question very carefully; it's hard to imagine someone would post what I just posted yet didn't even have the sense to simply search the disk beforehand...

 

[Slimfinger]

Thanks. But, ah, you certainly do know what is "irrelevant"! LOL

I simply do not appreciate what I consider disrespect when someone asks a question that is irrelevant to the problem at hand AND/OR the person demonstrates that he/she hasn't even bothered to pay attention to the problem. In this case, the experience demonstrated and undertaken by the poster and the context of the original post would make it clear that asking something like "why not back up the file?" is asking something that is not only blatantly obvious but also irrelevant, and therefore disrespectful of both the poster's time and and that of anyone else who is reading the thread. Similarly, proposing to "try searching the disk for the file" shows an utter neglect to read the original post. I appreciate any honest attempt to help, but I will not apologize for expecting a responder to have actually read the question beforehand.

As for your response: I was not at the computer when it rebooted (an idea that seems to have escaped the Windows 7 team). I have already tried each of your suggestions, but I am grateful for your response and your time.

 

[Saltgrass]

Since I have to assume the files you copied to other locations have also disappeared, I was wondering if you had sent the file to anyone as an attachment... Do you have any offsite storage locations that might have a copy?

The best way to avoid irrelevant questions is to enumerate what you have done previously. You might be surprised by how many problems are solved using an Obvious solution that was just missed.

Anyway, hope you find it.

 

[Slimfinger]

They were copied and then deleted. And yes, they are not to be found, either. Files were not sent to others, or offsite.

I have enumerated what has been done, so not sure what you meant there. I also checked what you suggested, though I did not enumerate them specifically. So certainly they were worth mentioning, and thanks.

There is no way to avoid irrelevant questions; by definition they can only be irrelevant if they clearly do not pertain to the given subject and facts. Perhaps you meant to say "obvious questions". Regardless, I simply get tired of dealing with an endless barrage of replies that show nothing short of laziness on the part of the reader. This is the norm, not the exception. My problem and what I have asked is presented very clearly.

 

[patcooke]

MS Word does not by default encode, encrypt or en* any doc, docx or doc*. The presence of text saved within any MS Word document in a normal manner on any media which has not been subjected to forensic wiping will be detectable by a search using a hex editor and may be recovered as I have done successfully on many occasions. If a range of text known to have been saved in a document fails to be detected by searches using a hex editor I would conclude that the document either was never saved to the disk or has been subjected to irrecoverable overwriting and in either case is irrecoverable.

The total absence of any document, remnant or log of what processing to which it may or may not have been subjected also refutes any attempt to impute cause of loss by "trashing" or any other demonstrable or unproven cause.

 

[Slimfinger]

As I speak, I am viewing a MS Word 2007 (.docx) document that I just created with some simple text in a hex editor. I am completely unable to discern any of the text or ASCII character codes in any recognizable form. I would greatly appreciate any advice you may have if I am in fact in error. Thanks!

 

[Saltgrass]

Because of what seems to have happened to your system, I was wondering if you had considered the possibility of a virus being involved? This won't help you recover the old file, but it might help in the future.

 

[Slimfinger]

MS Word does not by default encode, encrypt or en* any doc, docx or doc*. The presence of text saved within any MS Word document in a normal manner on any media which has not been subjected to forensic wiping will be detectable by a search using a hex editor and may be recovered as I have done successfully on many occasions. If a range of text known to have been saved in a document fails to be detected by searches using a hex editor I would conclude that the document either was never saved to the disk or has been subjected to irrecoverable overwriting and in either case is irrecoverable.

The total absence of any document, remnant or log of what processing to which it may or may not have been subjected also refutes any attempt to impute cause of loss by "trashing" or any other demonstrable or unproven cause.

@patcooke: will you please address my reply to you concerning your insistence that MS Word 2007 does not encode or encrypt documents by default? You seem absolutely sure of this, yet I am unable to confirm this either way via documentation. I certainly know that I have not proactively encrypted anything, and I know that no text created in any .docx that I have found is readable in a hex editor.

Also, I disagree with your closing statement. This file in question was saved. (It had been saved for weeks, edited for weeks, and never deleted.) That was a fact. In addition, the temp file prefixed by "~$" is created when a file is opened in order to store user data, and deleted when the file is closed. This file still exists - without its parent. The file was not "subjected" to any form of processing other than the MS Word application itself. No, I do not know EXACTLY what occurred (indeed, I would like to know), but I do know what I've stated here and in my original post - and given those facts one would have to be quite the fool not to assume that the OS itself (probably during a forced shutdown immediately preceding the file disappearance) is far and away the most likely culprit responsible for the loss of the file. In fact, it would be quite a stretch to explain it in any other way. (Bad HDD? Very, very unlikely.)

 

[patcooke]

@patcooke: will you please address my reply to you concerning your insistence that MS Word 2007 does not encode or encrypt documents by default? You seem absolutely sure of this, yet I am unable to confirm this either way via documentation. I certainly know that I have not proactively encrypted anything, and I know that no text created in any .docx that I have found is readable in a hex editor.

If you installed the software yourself and have not configured it for encryption or storage in some non-ASCII format then I have to confess I am currently at a loss to understand why there is no trace of the original text showing in a hex edit.

 

[Saltgrass]

Let me say we have all seen strange things happen on systems that we cannot explain (Gremlins). So what happened to you could be put in that category. Maybe if the power failed the hard drive write head hit the disk and did some damage.

Having said that, Windows is set up to protect your data in case of a power loss. Since the file you were working on was in memory and the original file was still on the hard drive, only something deleting or overwriting it could change that You have to see why it might be hard for us to accept the entire file has disappeared.

The file to which you refer, is an auto recovery file which links to another file that is refreshed every 10 minutes and keeps all changes made since the file was last saved. When your system came back up, you should have been offered an Auto Recovery to restore the file as it was, but that did not happen. Perhaps if the original file had been deleted for some reason, it could not do an auto recovery.

Did any other files disappear? Did chkdsk leave any file fragments with the .000 or .chk extension?

You did not respond to my Virus comment... it was just after April Fools day. But I have no suggestions for finding the file or any remnants of it. It appears, whatever deleted the file, did a good job. Perhaps when you are sure you cannot retrieve the file, try creating another one with the same name, then try to "restore previous. It might be best to not create it with Word, but maybe start it as a text file and change the extension. Just throwing out ideas.... you know, outside the box...