19 ms·

A surprising way to lose your files on Windows

366 points by raffraffraff 4y ago

This sad sequence of events just happened to a relative, and they're distraught. I haven't used Windows for ~15 years but since it was my area of expertise back then I still get lumbered with these problems. This one really surprised me though. They logged into Windows 7 (I know, upgrade...) and it looked like their files were missing. In a panic, they opened Explorer and searched for their files. They turned up in the search. They just didn't show up in the usual "My Documents", "My Pictures", "My Videos" paths. They decided to move the files "to the correct place". And then they shut the computer down. The next time they started it, the same thing happened. This is where I got called in, because this time, the files didn't show up in a search. I told them to turn the computer off immediately and drop it with me. Can you guess what happened? Well, check this out: - Windows couldn't use their user profile because it was corrupted - So it created a temporary profile in "C:\Users\TEMP". (This wasn't obvious to the user because Explorer hides the 'detail' of the file path and simply shows the username) - Unwittingly, when they moved the precious files to the "correct" place, they were putting them into a temporary profile. - On shutdown, Windows promptly deleted the temporary profile, so "C:\Users\TEMP" got wiped along with all of the files. I was frankly astonished that Windows would drop them into a temporary user profile without dire warnings about its transience. Anyway, now I have to try to recover not only the files, but the directory structures. I'm not even sure it's possible... :(

sammy2255 4y ago
You can use Recuva. Just make sure you run it from a USB or something. Try to prevent as many writes to that disk as possible
- raffraffraff 4y ago
  That was the option I was going to go with, but it means using my Wife's Windows machine. Also TestDisk or PhotoRec, but I don't think they can recover directory structure, so it would be thousands of files all higgledy-piggledy.
  - randerson 4y ago
    Without knowing what types of files they lost, this might not be too bad. For the first round of organizing, sort by file extension. E.g. Anything with .exe was probably Downloads, video files go to My Videos, and so on. A number of apps will organize JPGs into a consistent directory structure based on the date or other fields in the metadata. For the remaining documents, view by x-large icons so your relative can quickly categorize what goes where.
- Thaxll 4y ago
  Not if you have a SSD.
- raffraffraff 4y ago
  Well after using TestDisk and PhotoRec, not being happy with the results, I used Recuva and I now have over 90% of the data back with the correct directory structure. So for anyone reading this thread, I can't update the original post, but this is the answer. It's a GUI, it's super simple to use and it recovered files and folders better than any other free tool.
Victerius 4y ago
> Windows couldn't use their user profile because it was corrupted So this is the source of the problem. How does it happen?
- raffraffraff 4y ago
  I don't know yet. I'm currently creating a bit-copy of the disk using `dd`, and will start investigating the copy. So far, no disk errors.
  - 0x53 4y ago
    Was going to make sure you did this. There is a high chance you will be able to get a lot of the files back. You can use autopsy which is open source to carve for files. Or you might be able to use binwalk.
    - hyperman1 4y ago
      I got good results with photorec. Despit its name, it can recover other file types too. Beware: It takes ages, and finds absolutely everything, including e.g. the browser cache.
- pxeboot 4y ago
  A corrupt ntuser.dat file or profile permissions issue can trigger a temporary profile.
- jeroenhd 4y ago
  In my experience, unexpected power loss qnd bluescreens are the most common cause for these problems. Even Windows 7 was pretty good at keeping their system files consistent enough to be auto recovered.
StuckDuck 4y ago
> I was frankly astonished that Windows would drop them into a temporary user profile without dire warnings about its transience Does it? I recall using Windows 7 and being dropped into ~TEMP sometimes, but I was warned with a notification.
- bendiksolheim 4y ago
  This is probably not at all intuitive to the regular Windows user, my parents would never understand the implications of this.
  - wolrah 4y ago
    > This is probably not at all intuitive to the regular Windows user, my parents would never understand the implications of this The trick here is how do we solve this other than further user education? When the user profile folder is unusable for some reason you either have to do this or just refuse login. Neither are good answers, but this one is better as long as you understand what the system's doing. If one doesn't know what the system's doing and isn't interested in trying to understand it I don't see a way to avoid this issue.
    - cesarb 4y ago
      > When the user profile folder is unusable for some reason you either have to do this or just refuse login. Neither are good answers, but this one is better as long as you understand what the system's doing. As this whole discussion shows, no, this one is worse since it can easily lead to data loss. A third option, however, would be to do this but not erase the profile on logout.
      - bscphil 4y ago
        Or an even better fourth option: the warning message literally says "you cannot access your files". https://i.imgur.com/6jk6imp.png https://i.imgur.com/6jk6imp.png That is apparently false because the user did access their files and dragged them into the temp profile. Either that should be literally true (a completely broken profile is a bad problem that needs help from a competent tech support person) or the profile should at least be made read-only until the entire profile is deleted. That way they could copy the files into the temp folder, but not lose anything (other than changes) after logging out. Also, the warning should be more obviously "fatal", not something to be clicked through. E.g. replace the desktop background with a black screen and put the warning text in red on it.
amelius 4y ago
Can't you recover the files using some tool? I remember undeleting was possible in the old FAT days.
- sgjohnson 4y ago
  Theoretically yes. Deleting a file doesn’t actually delete anything, besides the file table entry. The contents still remain on the disk, until they get overwritten, that is.
timbit42 4y ago
I've seen this happen a number of times. Pretty sure I first saw it on WinXP.
pwg 4y ago
Sorry for your relatives experience, that must be very distressing for them. However, this also shows why having a "backup" is always a good idea. So when/if you do recover what you can recover, you might also consider setting them up with some form of automatic backup such that should this (or a disk failure, which is always a possibility) occur in the future, recovery can be "restore from latest backup" instead of the task you are now facing.
- raffraffraff 4y ago
  Haha, I asked "Is there a backup?". Answer: "Yes, but it's from months ago"
  - inetsee 4y ago
    A backup from months ago is (somewhat) better than a backup from years ago or no backup at all.
  - layer8 4y ago
    Buy them a second drive (if possible) and activate File History with that drive as the target.
- magicalhippo 4y ago
  Of course backup is always a good idea. However, an equally good idea when faced with a sudden and utterly unexpected situation, is to not immediately try to solve the problem without understanding what actually happened. The chances of the "fix" doing more harm than good is high. That said, consumer software should definitely not assume that the user understands how the internals work. In this case, rather than a popup being shows, it would have been more appropriate to give the user a full-screen walkthrough, similar to the first-launch experience, explaining what has happene, what Windows has done, that the documents and pictures are most likely safe, and finally include warnings about the active profile, and associated documents and pictures, being deleted when logging out.
  - herpderperator 4y ago
_Microft 4y ago
Was the profile actually corrupted or was that their interpretation? Losing connection to an online Microsoft account can also result in a user ending up with a temporary account. (My story: just last week I fixed a temporary profile issue for an acquaintance and all that had happened was that Windows messed up the connection with her online Microsoft account. After signing out and in again, it worked fine. I was surprised at first because I wasn't aware that such a thing as temporary profiles existed. It became clear that she was working on a wrong profile once I opened a shell and the path before the prompt said "c:\users\temp".) There are definitely warnings that any work/data stored in the temporary profile would be lost, so maybe they did not take these seriously enough. The only thing that I actually find absolutely unforgivable is that the temporary profile is named after her normal account. Creating temporary accounts with ample warnings, yeah, not great. Pretending to be the profile of the user...? Nope
- raffraffraff 4y ago
  The temporary profile doesn't really pretend to be the user, but Explorer's default (which I hate) is to obscure the full path, "C:\Users\TEMP" and just show the username. You have to hit "CTRL + l" to see the actual path. You can't even navigate 'up' a directory to see where you are, and if you right-click in that directory there is no "Properties". I tried talking them through this on the phone before they shut the computer off. It was basically impossible to figure out over the phone. This type of "magic" bullshit really irritates me.
  - denton-scratch 4y ago
    > This type of "magic" bullshit really irritates me. Microsoft seems to have tried to get rid of outmoded notions such as directories, without ever articulating what new model they favoured. So you get these privileged spaces (I have no better word) like "Documents". They've tried to make Explorer as invisible as possible. But they never finished the job! So you end up with a mess of "AppData" (apparently a normal directory) and "Application Data" (not accessible). I presume the first is an alias for the second; but the second should be invisible if it's not accessible (there are other directories like this). This started with Win7. Then they stopped abruptly, but never reverted these aborted changes. It's as if there's nobody in charge. My guess is that forcing Microsoft accounts, "instrumentation", and failed attempts to hegemonize mobile were prioritized over fixing what they'd broken. NT4 was a reasonable OS, with a rotten commandline. Nothing they've shipped since has come close.
squarefoot 4y ago
Give TestDisk a try. Years ago I have been able to use it to recover almost all files from a unreadable disk coming fom a RAID1 mirror gone bonkers due to a faulty controller. https://www.cgsecurity.org/wiki/TestDisk https://www.cgsecurity.org/wiki/TestDisk edit: oh, I just read that you mentioned TestDisk. Yes, it can recover the directory structure, at least it did in my case. After using it you will likely see that some files have been duplicated with a suffix added, like document.doc and document.doc.xyz (can't recall the exact suffix) in the same directory. In that case you need to check which file has been fully recovered, and rename it if needed.
- jqbdwst 4y ago
  TestDisk is a miraculous tool !
  - raffraffraff 4y ago
    TestDisk is cli-only. I decided to have a look at PhotoRec (created by the same folks as TestDisk). It has a handy QT gui. Unfortunately, the only option is to scan the disk for selected file types and dump them all into a chosen location. This loses folder structure, so years of files will all get blended. I'd prefer an undelete option that can target "C:\Users\TEMP\Documents" etc, but this might be asking too much. Gonna try TestDisk next..
    - axiolite 4y ago
      Testdisk is great when you need to recover a whole partition, but not nearly as capable and advanced when it comes to recovering deleted files. You'll do much better with purpose-build Windows undelete utilities. I've had good luck with freeundelete: https://www.officerecovery.com/freeundelete/ https://www.officerecovery.com/freeundelete/
    - sorenjan 4y ago
      Recuva has worked well for me in the past, it has a "Restore folder structure" option in the settings. https://www.ccleaner.com/recuva https://www.ccleaner.com/recuva
pxeboot 4y ago
Temporary profiles have been a feature on Windows for many years. Likely intended as a way to login when a roaming profile isn't available on the network, not something a home user would care about.
anvic 4y ago
[dead]
- happytoexplain 4y ago
  Since the notification area, like on mobile, tends to become full of garbage, users rightfully do not expect it to be a place where hyper-critical information like this will appear, or at least not using the same format. Further, this wording is inadequate. The vast majority of people would reasonably not understand that dragging your pictures back to the My Pictures folder, where they already were moments ago, is what the message means by "creating files in this profile". Further still, there's no reason for Windows to choose not to behave in a reasonable way in this scenario (e.g. prevent writes to the profile, or show a dialogue when you try to write using Explorer, saying "if you do this, the files will be deleted").
- marcosdumay 4y ago
  Yeah, that's definitively not enough notification. When you have a similar problem on Linux, and you home is inaccessible or read-only, you get an almost screen-sized dialog, no desktop background (something hard to replicate on your settings), and the system theme (that is probably different from your DE's default).
  - jodrellblank 4y ago
    You will on current supported Windows versions as well: https://www.windowsphoneinfo.com/attachments/97fdf7d3-6fca-4a29-92bb-1319b6575bf2-upload-true-png.91063/ https://www.windowsphoneinfo.com/attachments/97fdf7d3-6fca-4... Windows 7 left extended support two and a half years ago, mainstream support seven years ago, and hasn't been in development for eleven years. (Like commenting from Windows XP in 2001 that Windows 3.11 in 1993 had an unhelpful dialog box).
    - userbinator 4y ago
      The picture of the notification there in the original comment is from Windows 10.
somat 4y ago
My condolences, I had a corrupt profile once, I was a bit angry that I could find no way to uncorrupt it. I could find no tools that would fix it. I ended up having to remove the user and create a new one. Thankfully no file loss but the whole process was made harder than it should have been because the only user account on the system was the corrupt one and it refused to log in due to the profile problem. My lessons learned from it. windows profiles are far too complicated, it was hard to find low level information on how they work or how to diagnose and fix a bad profile. make sure you have and know another login. preferably the admin one.
- mnahkies 4y ago
  My memory is shaky as it's been a while since I used it, but I vaguely remember there being a hidden built-in administrator account that could possibly be used in this situation. Can't remember if you would need to set a password on it / enable it ahead of time though Edit: this might be what you meant by the admin one (rather than a)
- sgtaylor5 4y ago
  Would this have helped? https://www.sevenforums.com/tutorials/186131-user-profile-service-failed-logon-user-profile-cannot-loaded.html https://www.sevenforums.com/tutorials/186131-user-profile-se...
darepublic 4y ago
I had a resume.json file under my user folder and windows 10 simply won't find it in the search bar. It will find another identically named file on a folder on desktop. I have no idea why it cant find it and I'm sure these is some setting I could look up to ameliorate the problem but I am still blaming windows for this.
- layer8 4y ago
  For filename-based search, use Everything: https://www.voidtools.com/ https://www.voidtools.com/. It’s much faster and more reliable than Windows search.
  - nope96 4y ago
    Wow, I haven't thought about that program for years. I'd thought it was abandoned.
  - jtmaher 4y ago
    Another good one is Fast File Finder https://blog.kowalczyk.info/software/fast-file-finder-for-windows/ https://blog.kowalczyk.info/software/fast-file-finder-for-wi.... It's by the same guy who made SumatraPDF.
- alpaca128 4y ago
  It may just be settings but that's just as inexcusable. If default settings prevent a search feature to find exact filename matches on a system targeted at end users, the default settings are broken. What is so baffling to me is that it's not being fixed. It would be understandable if it only affected power users or if it was a launch-day issue getting patched in the first week. But it isn't.
  - lazide 4y ago
    Lately Microsoft has been breaking a lot of bread and butter type stuff. See the recent experiences with Notepad or Voice Recorder for examples.
- 4y ago
ThrowawayTestr 4y ago
Recuva is a great freeware tool to restore files.
- Thaxll 4y ago
  Once you have a SSD you can't get back deleted files.
  - laborat 4y ago
    Only after the volume has been trimmed, which by default happens only once a week in Windows, IIRC.
    - Thaxll 4y ago
      No, the TRIM happen the moment you delete the file.
      - lazide 4y ago
        Not anymore on windows or Linux. It tends to cause wear issues on many SSDs
        Thaxll 4y ago
        Well do the test on windows, delete a single file and try to get it back. https://www.youtube.com/watch?v=hzClnwGeJUM https://www.youtube.com/watch?v=hzClnwGeJUM
        lazide 4y ago
        I did a couple months ago to a number of files. Worked fine. Windows 10, all solid state storage.
  - ThrowawayTestr 4y ago
    I've recovered deleted files from an SSD before.
dmfdmf 4y ago
Win7 had an occassional timing issue where it would try to start before the profile could be read so it would boot to a temp profile. The main symptom is that all the user's files and desktop icons were gone. I would just have them reboot then it would be fine but it would need a tuneup, chkdsk, delete tmps, etc. as long as the drive wasn't really old. It used to be more common before the move to SSDs instead of HDDs but a Win7 computer's drive is probably really old, so yes, time for a new PC. In this case the deleted files would have to recovered. I recently use Easus Data Recovery Wizard and was able to restore a lot of files for a client who's photo storage drive crashed. It would be best to pull the drive and do the recovery on another computer. I think the free tool allows up to 2GBs of data recovery but in this case the client had 100's of GBs so he paid for a 30 day license for $65.
dataflow 4y ago
Try Recuva, IsoBuster, etc. And take an image before booting the disk.
swayvil 4y ago
Being a Linux user (Debian, Mate), I have never suffered "profile corruption". Or "lost" a file that I recall. Is this a normal thing in Windows?
- deleted 4y ago
  [deleted]
- guilhas 4y ago
  I have lost, dd'ing the main disk/partition by accident while creating boot usbs, several times
  - swayvil 4y ago
    That is definitely a way to do it. DDing is scary to me.
- RedShift1 4y ago
  Just because it didn't happen to you, doesn't mean it didn't happen to anybody else. I got hit by the ext4 empty-files-after-crash that corrupted my KDE profile back in the day.
brudgers 4y ago
It sucks to lose files. Not having a backup is a platform agnostic way to lose files, and works pretty reliably given sufficient time. Windows 8 came out in 2008.
- 2143 4y ago
  > Windows 8 came out in 2008. Typo; you meant to say 2012.
nazgulsenpai 4y ago
Not that this fixes your immediate problem but just an FYI for anyone who might be in a similar situation in the future, in the 10+ years I've been in IT I've used the free ForensIT Profwiz, Transwiz and Defprof for any of these weird profile issues with success. Not affiliated in any way, just a sporadic user. https://www.forensit.com/ https://www.forensit.com/
- lillecarl 4y ago
  Back when I did Windows work I used their tools too, great quality!
hulitu 4y ago
Never ever store valuable files on those "virtual folders" on Windows: My Documents, My Pictures etc. Avoid storing valuable files in the user profile. Windows will get confused and you might lose data. This is especially true if you use a local language in windows.
- navjack27 4y ago
  Yeah don't store things in those virtual folders... Store them in c:\users\username\documents instead. Much safer.
  - fuzzfactor 4y ago
    People often forget what the transition was like from office machines, manual spreadsheets, and filing cabinets to having a single PC that could replace these for you if you really try. But you really have to try and put in some effort here. Without taking action to have it your way, you'll be left to the default approach which Microsoft has molded for users who may never grasp filing systems at all, which is simultaneously backward-compatible with DOS. And then third-party software which sometimes tries to better cope by having their own layer of obscurity which can help your workflow but the filing can end up even more ugly. But the filing cabinet never was an office machine anyway, and as far as automatic, I would much rather have a real intelligent secretary file & retrieve my folders than I would a machine. And without a secretary I figure I'm going to have to put in some effort my dang self, and get the most out of the electronic filing at my fingertips. The C: volume containing DOS or Windows was subject to the most frequent defects or corruption and could be considered the most risky place to put any of your valuable data if you could help it. But regular PCs for office or home were supplied with only one partition on their HDD so there was no separate volume that could be dedicated exclusively for storage. The highest-reliablity upgrade was having a second hard drive dedicated for storage, but naturally you had to work from a blank slate and label all the folders yourself just like a secretary would do. Further you need to be very vigilant and direct any valuable data from all Windows or third-party apps to your dedicated folders every time. However nobody actually needed this drive space at the beginning since that's when there's always plenty of room on C:. But it was worth it. Be your own secretary. Yes the C: drive was still a PITA to restore but it was good to maintain readiness to Format C: at any time without losing any valuable data at all. Then restoring only the system (Windows, installed apps, and settings) quickly from backup, or alternatively reinstalling them in the previously optimized repeatable full recovery procedure. Always install programs to C: right along with Windows. To a newer, faster, or bigger HDD whenever you felt like it. The C: drive was like the office machine substitute, where you need to be able to change some of the things on your desktop or even get a whole new desk from time to time, but you wouldn't want to handle your company files and their filing system as disposably as you would a broken office machine. And the second HDD volume was the filing cabinet substitute, which could physically be moved or copied and placed into a different office without affecting the desk or desktop that generated the data. Now this was before the Documents And Settings folder appeared. Which pushed the mainstream in the opposite direction, placing your valuable data by default into folders automatically labeled and tucked away largely within deeply nested trees within Windows' increasing number of self-created folders, and completely downplaying any underlying need to know the filing system at all. Instead of all being in one filing cabinet, your data became a "part" of Windows and it became acceptable for your files to be less accessible to your fingertips alone. Not without Windows and each App in question being there in perfect working order. And with temporary files from the internet growing right there in the same folders, rendering your relatively small number of useful business files more like a needle in a haystack as time goes by. Is this risk really worth it just to have the simplified option of multiple users in offices where everyone needs their own Personal Computer to begin with? Anyway they basically call it the Users folder now and you've got a symbolic link from Documents And Settings, so the woods got deeper that time too. I hate having to knock down more trees just to get stuff done. Even when paperwork has been my only product so much of the time. With effective multi-partitioning it became within reach to have separate volumes for Windows vs. Your Data, when you only have a single HDD. You do have to take action from there. Which is a step in the right direction but with fast external USB drives it's one of the best ways to physically separate your personal filing cabinet from your office/machines again. Plus externally store your well-tested working backups of Windows' less-sizable full C: volume itself as .WIM files, to hammer a reformatted C: often with, which can be quicker than defragmenting with about the same outcome if you do it right. Losing a laptop doesn't have to be so bad if there are no credentials or company data on board to begin with, but as always don't leave your stuffed filing cabinet in your competitor's reception area. Especially if it fits in between the couch cushions.
actionfromafar 4y ago
I once recovered most of my pictures with https://sleuthkit.org/ https://sleuthkit.org/
EVa5I7bHFq9mnYK 4y ago
Sorry, a tangential question ... my friend's 2011 Macbook Air's hard drive gave up and she has all of her photos there. The Macbook doesn't boot, just shows a white screen. Can the photos be salvaged somehow?
- hunter-gatherer 4y ago
  I'm not sure off the top of my head if MacOS was encrypting the drive at that time, but you might try plugging the drive into FTK Imager or Autopsy. I believe both of these tools will do some data carving. But before you do that, make sure the issue isn't the hard drive itself. If the hard drive is damaged, you may still be able to recover data, but it'll need to be done by someone who knows what they are doing. If the drive is spinning irregularly, or clicking, or not recognized by another system you might have issues. Source - I used to work in a digital forensics lab.
  - EVa5I7bHFq9mnYK 4y ago
    thank you!
  - netsharc 4y ago
    Wow, my guess was since it was 2011, they would've still been using an old-fashioned spinning disk or probably an SSD with that form factor and normal SATA connection, but they were already using M.2 SSD, but a Frankenstein one where an adapter is needed: https://d3nevzfk7ii3be.cloudfront.net/igi/n4Fo16YKi45Y5JxL.full https://d3nevzfk7ii3be.cloudfront.net/igi/n4Fo16YKi45Y5JxL.f... Source: https://www.ifixit.com/Guide/MacBook+Air+11-Inch+Mid+2011+Solid-State+Drive+Replacement/6317 https://www.ifixit.com/Guide/MacBook+Air+11-Inch+Mid+2011+So...
    - hunter-gatherer 4y ago
      That is surprising! I also assumed that being a 2011 it would be a spinning disk drive.
      - 4y ago
signaru 4y ago
This is why my work documents and data are always on a second drive (or partition if hardware is limited). I haven't used the default Windows folders for years and it's only some software creating folders under "My Documents" that I just ignore. You never know when you'll have to reformat the main Windows drive. It also proved convenient when I changed computers as I just plugged in the data drive I had always been using, and all my familiar documents are there. Of course, there's also the cloud to backup the more important stuff.
- dsego 4y ago
  That's why on linux you can mount your home directory to a separate partition. You can reinstall the OS but still keep all your files and settings intact. And even better, it's the default location like "My Documents" so the OS and apps know where to look for things.
jhoechtl 4y ago
Well the mistake was to move files first place. Should have done a copy first, check if everything is ok and then delete.
- raffraffraff 4y ago
  You're right of course, but this is a man in his 70s who didn't want to bother me again to fix his old laptop.
- iudqnolq 4y ago
  Huh? Assuming they was actually no warning, I doubt any of us would reboot before the check in that sort of process.
WalterBright 4y ago
> This wasn't obvious to the user because Explorer hides the 'detail' of the file path and simply shows the username I really really dislike Windows when it hides paths, for example, "My Pictures". Where the heck is that? This lunacy infects Windows applications, like Quicken and Thunderbird, which spew themselves and their data into gawd knows where hidden directories. Why can't they simply do the obvious? Create a \Quicken directory in the root, and have a \Quicken\program and \Quicken\userdata ? But noooo.
- mananaysiempre 4y ago
  > Why can't [Quicken and other Windows apps] simply do the obvious? Create a \Quicken directory in the root, and have a \Quicken\program and \Quicken\userdata ? Networked machines. (Aside from the obvious security problems on a multi-user installation.) The "gawd knows where hidden directories" (of which there are two, %APPDATA% and %LOCALAPPDATA%, plus, on a recent Windows version, a number of compatibility links and some sort of integrity level thing) are segregated into the part which should have an authoritative copy on the file server ("roaming") and the part that can or has to stay on the workstation ("local").
  - carrolldunham 4y ago
    I can't believe windows doesn't offer an option "this is my laptop, nobody else is ever going to use it". I hate logging in to my own laptop and having a user folder like some loser student in a library
    - navjack27 4y ago
      Every OS is like this... Except Haiku. And you aren't the only user on pretty much every OS. There are many many many built in "users" for different internal operations.
      - smaudet 4y ago
        Not relevant. Every OS also has different levels of user. Your user should be the admin, shouldn't be tied a profile etc. Linux is setup like more like this. Yeah, it makes it more complex for certain network style things (you have 4 computers and want to sync between them), but it's trivial to work around. The reason Windows is built like this is they develop first for enterprises and libraries, everyone else gets the shitty castoffs...
ComodoHacker 4y ago
> Windows would drop them into a temporary user profile without dire warnings about its transience. I'm sure there was some warning. But you know, users don't read messages...
Dwedit 4y ago
Just don't use your user profile directory at all. If you really want to, replace the directories with Junction Points that point elsewhere. Then if your User Profile gets deleted, nothing will happen to the files.
- userbinator 4y ago
  If you really want to, replace the directories with Junction Points that point elsewhere. After https://news.ycombinator.com/item?id=18189139 https://news.ycombinator.com/item?id=18189139 , I don't think I want the OS to know where else I'm storing my files.
angry_octet 4y ago
This unfortunately highlights a key forensics requirement: don't touch the computer. Don't turn it on, don't turn it off, don't login/logout. Ideally keep the wifi router turned on, but disconnect it from upstream internet. It's very hard to get people to follow this of course but it's critical, especially now FDE is becoming more common. In the extreme case you can leave it on until you can cause an exploit remotely or are ready to immerse it in liquid nitrogen and extract the FDE keys from RAM. There are tools (wiebetech.com) for moving plugged in computers onto battery power if you can't work in situ or can't risk a grid outage.
- DerekBickerton 4y ago
  This. To be honest, I think it's a miracle that my machine boots at all. Most people take it for granted, but I cherish each day it boots and I don't have to do a clean install because something breaks (typically some bizarre edge case scenario unique to Windows that only breaks on my machine). There is the old saying: if it works, don't try to fix it.
- autoexec 4y ago
  > It's very hard to get people to follow this of course but it's critical We've spent decades telling users that the miracle fix for all their technology problems is turning your device off and on again. That's going to a long time to undo.
- discardedrefuse 4y ago
  You can't ask people to treat every "user can't find file" situation as a forensic investigation.
  - angry_octet 4y ago
    This is easy to triage! Q1 - Would you be very very upset if all the data on your computer was lost Y/N Q2 - Do you have backups of this data? (The answer is invariably No.) Q3 - Is your computer behaving strangely? Do you have a spidey sense of doom which caused you to contact me? Y/N At which point it should be clear that further unqualified FA&FO is a bad idea.
seqizz 4y ago
I recovered a lot with RMF, not sure if it still has the vibe though, that was a decade ago. [link] https://getdata.com/recovermyfiles/ https://getdata.com/recovermyfiles/
rejectfinite 4y ago
>I was frankly astonished that Windows would drop them into a temporary user profile without dire warnings about its transience. There is warnings... Now the Win7 one is just the notification baloon and easy to miss but the 10 one is pretty "in your face" Windows 7: https://imgur.com/a/ao5AtO6 https://imgur.com/a/ao5AtO6 Windows 10: https://imgur.com/a/Hl9XnZV https://imgur.com/a/Hl9XnZV
- mrtksn 4y ago
  Too long and too verbose and too ordinary for such an critical warning. The title "You have been logged on with a temporary profile." is so unoffencive that doesn't really make you read the paragraph explaining what it means. It sounds like something that you can deal with later, it should be "All files will be deleted upon sign out" and then you can read and learn that this is a temporary profile. Windows likes to tell stuff of no urgency all the time and people will close those click. click. click. IMHO when the computer is used in extraordinary situation the UI should be making it very clear. Probably all kind of customisation should be removed so the user feel like in wrong place and has high alertness. When moving files into folders that will be deleted the user should be warned with a short and scary message(macOS warns you that the files will be deleted from the cloud if you move files out of iCloud synced folders like Desktop and Documents).
  - naikrovek 4y ago
    guess what? all customization is removed, because that configuration is stored in the user profile.
    - mrtksn 4y ago
      Good point but just in case if the user has not been using a customised UI, maybe everything should look non-default and out of place. If I remember correctly, the system defaults to a low resolution when something goes wrong and this may help. The point is, the user should be made aware that this is not business as usual and proceed with extreme caution. A popup with cryptic title and long paragraph won't do it.
fortran77 4y ago
There really shouldn't be any problem! Disk drives on any operating system can fail at any time. All they have to do is simply restore from their backups. Shame on Hacker News for doing this juvenile "Mico$oft WINDOWS BAD" crap. It's boring and stupid.
whywhywhywhy 4y ago
>(This wasn't obvious to the user because Explorer hides the 'detail' of the file path and simply shows the username) I hate how Explorer tries to be clever with the Documents etc folders but it just makes it obtuse. Like if I open Documents from the side bar and press Up Directory I end up in My Computer not my home folder.
naikrovek 4y ago
> frankly astonished that Windows would drop them into a temporary user profile without dire warnings about its transience. windows didn't drop them into a temporary user profile; the user did that. windows assumes that you know what you're doing when you move files around. everyone loses their minds when it doesn't make this assumption.
- detaro 4y ago
  How did the user actively drop themselves into a temporary user profile?
  - unnouinceput 4y ago
    You'd be amazed how people just drag'n'drop stuff they don't understand, and given that in Windows you're the "root" (Administrator) all the time, then you can guess how easy was that.
    - detaro 4y ago
      that's clearly not what the original line meant by "drop into".
  - naikrovek 4y ago
    the user dropped the FILES into a temporary user profile. Windows tells you when it logs you into a temporary user profile. it doesn't do that silently.
aabbcc1241 4y ago
Back in the day when I used windows, there is a tool "Recuva"[1] that scan the harddisk to recover deleted files. As long as the block on harddisk is not overwritten by new content, it can restore the deleted files. [1] https://www.ccleaner.com/recuva https://www.ccleaner.com/recuva
glitchc 4y ago
Check out PhotoRec: https://www.cgsecurity.org/wiki/PhotoRec https://www.cgsecurity.org/wiki/PhotoRec
fuzzfactor 4y ago
Try DMDE.
ck2 4y ago
Buy them an 8TB external hard drive for $150 Tell them to flip it on once a week if not more often. Press the backup button. Turn it off when done. Now they have the ultimate offline backup for a full restore regardless of corruption, virus, hacked, etc.
1970-01-01 4y ago
3 failures here: Windows - 1) Automatically forced a temporary profile creation instead of asking to do so. 2) Forced automatic temp profile alert was too small and quiet, so the end-user simply ignored it. User- 3) No backups.
phendrenad2 4y ago
This is probably such a rare event, your relative might have been the only person in history to do this. So I'm not exactly impressed by the "badness" here.
navjack27 4y ago
How do so many people commenting on this seem to universally agree about being confused by Windows file structure? Like, look https://learn.microsoft.com/en-us/windows/deployment/usmt/usmt-recognized-environment-variables https://learn.microsoft.com/en-us/windows/deployment/usmt/us... Those are the path variables Ez But logically? How hard is c:\users\username\whatever? Are you all so so so into Linux that you are just utterly flabbergasted by the simplicity of Windows? All operating systems hide hidden paths also. You can enable showing hidden paths. You should just know where programdata is where appdata is... The difference between local and roaming and locallow... I mean cmon nerds! Get with it! On Linux or Mac. Tell me. Where is Documents? Where is Pictures? Where is applications? Is Documents in ~/Home/Documents? Where is that if I'm not the current user? Why is Applications on Mac in my home folder different than the Applications in Macintosh HD/Applications? Why can I Macintosh HD/Volumes/Macintosh HD/Volumes/? Windows is somehow the insane one? Windows makes sense! Instead of all agreeing that you're confused by something that you should be an expert in at this point if you are working in the computer space at all... Maybe you should take some time out to actually brush up on some skills that could be useful that you could help family members with. Because bitching around the sewing circle isn't going to inspire confidence and it's not going to help your case in any sort of way that you would think if you actually want to change or improve the situation of file system hierarchy. Remember, we are the nerds that know everything! Act like it! If Windows is so beneath you; then master it completely! Don't just ignore it because you think you're so much better than it. I see so many comments and threads on hacker News constantly where people are just like "I haven't touched windows in 15 years and then I had to touch it last week and oh my God this and that and this and that." And to me that is just the sign of someone who gave up.
- geocrasher 4y ago
  This. So. Much. This.
- tuatoru 4y ago
  > How hard is c:\users\username\whatever? Not hard at all. But Windows really, really goes out of its way to fight me using that. > You can enable showing hidden paths. You should just know where programdata is where appdata is... Yeah, because the onboarding tutorial for new accounts explains all that. Not. Some of us do know this stuff, and we can sort of understand why Microsoft made the decisions they did (they make sense, or at least less nonsense, in large corporate environments of Word users). But they are still a nasty product of the "reach for abstraction" impulse of programmers with not enough experience to know that they're working outside their zone of mastery.
albert_e 4y ago
temporary profile can access files belonging to a different profile that the user was unable to log into ? and move / effectively delete them all? why does a temporary profile have such privileges
sedawk 4y ago
I might have some recommendations, please reach out to me if you're still struggling to recover the files
Sakos 4y ago
I think the actual issue is that the files showed up in the search, allowing the user to do something that would lead to disastrous consequences. How did that happen from a temporary profile? Why does that temporary profile have access rights to the previous profile? Also, I'm not entirely certain that Windows automatically deletes temporary profiles.
animal531 4y ago
A long time ago at one of my first jobs we had a guy who stored his files in the Recycle Bin, when asked why he indicated that he liked the icon. Of course the bin eventually recycled his files which led to him finally reaching out for help.
eitland 4y ago
Have you recovered them yet? As long as they are just "deleted" and not overwritten, file recovery on Windows used to be easy.
Razengan 4y ago
@HN/Damg: How the hell are we supposed all that text by OP if it’s deliberately faded out? Gray on beige, really? Do we have to wait for YOUR eyesight to worsen before you realize some basic usability?
CrazyIvan 4y ago
GetDataBack for NTFS with full scan should be able to recover files.

366 points by raffraffraff 4y ago

sammy2255 4y ago

You can use Recuva. Just make sure you run it from a USB or something. Try to prevent as many writes to that disk as possible

raffraffraff 4y ago
That was the option I was going to go with, but it means using my Wife's Windows machine. Also TestDisk or PhotoRec, but I don't think they can recover directory structure, so it would be thousands of files all higgledy-piggledy.
- randerson 4y ago
  Without knowing what types of files they lost, this might not be too bad. For the first round of organizing, sort by file extension. E.g. Anything with .exe was probably Downloads, video files go to My Videos, and so on. A number of apps will organize JPGs into a consistent directory structure based on the date or other fields in the metadata. For the remaining documents, view by x-large icons so your relative can quickly categorize what goes where.
Thaxll 4y ago
Not if you have a SSD.
raffraffraff 4y ago
Well after using TestDisk and PhotoRec, not being happy with the results, I used Recuva and I now have over 90% of the data back with the correct directory structure. So for anyone reading this thread, I can't update the original post, but this is the answer. It's a GUI, it's super simple to use and it recovered files and folders better than any other free tool.

Victerius 4y ago

> Windows couldn't use their user profile because it was corrupted So this is the source of the problem. How does it happen?

raffraffraff 4y ago
I don't know yet. I'm currently creating a bit-copy of the disk using `dd`, and will start investigating the copy. So far, no disk errors.
- 0x53 4y ago
  Was going to make sure you did this. There is a high chance you will be able to get a lot of the files back. You can use autopsy which is open source to carve for files. Or you might be able to use binwalk.
  - hyperman1 4y ago
    I got good results with photorec. Despit its name, it can recover other file types too. Beware: It takes ages, and finds absolutely everything, including e.g. the browser cache.
pxeboot 4y ago
A corrupt ntuser.dat file or profile permissions issue can trigger a temporary profile.
jeroenhd 4y ago
In my experience, unexpected power loss qnd bluescreens are the most common cause for these problems. Even Windows 7 was pretty good at keeping their system files consistent enough to be auto recovered.

StuckDuck 4y ago

> I was frankly astonished that Windows would drop them into a temporary user profile without dire warnings about its transience Does it? I recall using Windows 7 and being dropped into ~TEMP sometimes, but I was warned with a notification.

bendiksolheim 4y ago
This is probably not at all intuitive to the regular Windows user, my parents would never understand the implications of this.
- wolrah 4y ago
  > This is probably not at all intuitive to the regular Windows user, my parents would never understand the implications of this The trick here is how do we solve this other than further user education? When the user profile folder is unusable for some reason you either have to do this or just refuse login. Neither are good answers, but this one is better as long as you understand what the system's doing. If one doesn't know what the system's doing and isn't interested in trying to understand it I don't see a way to avoid this issue.
  - cesarb 4y ago
    > When the user profile folder is unusable for some reason you either have to do this or just refuse login. Neither are good answers, but this one is better as long as you understand what the system's doing. As this whole discussion shows, no, this one is worse since it can easily lead to data loss. A third option, however, would be to do this but not erase the profile on logout.
    - bscphil 4y ago
      Or an even better fourth option: the warning message literally says "you cannot access your files". https://i.imgur.com/6jk6imp.png https://i.imgur.com/6jk6imp.png That is apparently false because the user did access their files and dragged them into the temp profile. Either that should be literally true (a completely broken profile is a bad problem that needs help from a competent tech support person) or the profile should at least be made read-only until the entire profile is deleted. That way they could copy the files into the temp folder, but not lose anything (other than changes) after logging out. Also, the warning should be more obviously "fatal", not something to be clicked through. E.g. replace the desktop background with a black screen and put the warning text in red on it.

amelius 4y ago

Can't you recover the files using some tool? I remember undeleting was possible in the old FAT days.

sgjohnson 4y ago
Theoretically yes. Deleting a file doesn’t actually delete anything, besides the file table entry. The contents still remain on the disk, until they get overwritten, that is.

timbit42 4y ago

I've seen this happen a number of times. Pretty sure I first saw it on WinXP.

pwg 4y ago

Sorry for your relatives experience, that must be very distressing for them. However, this also shows why having a "backup" is always a good idea. So when/if you do recover what you can recover, you might also consider setting them up with some form of automatic backup such that should this (or a disk failure, which is always a possibility) occur in the future, recovery can be "restore from latest backup" instead of the task you are now facing.

raffraffraff 4y ago
Haha, I asked "Is there a backup?". Answer: "Yes, but it's from months ago"
- inetsee 4y ago
  A backup from months ago is (somewhat) better than a backup from years ago or no backup at all.
- layer8 4y ago
  Buy them a second drive (if possible) and activate File History with that drive as the target.
magicalhippo 4y ago
Of course backup is always a good idea. However, an equally good idea when faced with a sudden and utterly unexpected situation, is to not immediately try to solve the problem without understanding what actually happened. The chances of the "fix" doing more harm than good is high. That said, consumer software should definitely not assume that the user understands how the internals work. In this case, rather than a popup being shows, it would have been more appropriate to give the user a full-screen walkthrough, similar to the first-launch experience, explaining what has happene, what Windows has done, that the documents and pictures are most likely safe, and finally include warnings about the active profile, and associated documents and pictures, being deleted when logging out.
- herpderperator 4y ago

_Microft 4y ago

Was the profile actually corrupted or was that their interpretation? Losing connection to an online Microsoft account can also result in a user ending up with a temporary account. (My story: just last week I fixed a temporary profile issue for an acquaintance and all that had happened was that Windows messed up the connection with her online Microsoft account. After signing out and in again, it worked fine. I was surprised at first because I wasn't aware that such a thing as temporary profiles existed. It became clear that she was working on a wrong profile once I opened a shell and the path before the prompt said "c:\users\temp".) There are definitely warnings that any work/data stored in the temporary profile would be lost, so maybe they did not take these seriously enough. The only thing that I actually find absolutely unforgivable is that the temporary profile is named after her normal account. Creating temporary accounts with ample warnings, yeah, not great. Pretending to be the profile of the user...? Nope

raffraffraff 4y ago
The temporary profile doesn't really pretend to be the user, but Explorer's default (which I hate) is to obscure the full path, "C:\Users\TEMP" and just show the username. You have to hit "CTRL + l" to see the actual path. You can't even navigate 'up' a directory to see where you are, and if you right-click in that directory there is no "Properties". I tried talking them through this on the phone before they shut the computer off. It was basically impossible to figure out over the phone. This type of "magic" bullshit really irritates me.
- denton-scratch 4y ago
  > This type of "magic" bullshit really irritates me. Microsoft seems to have tried to get rid of outmoded notions such as directories, without ever articulating what new model they favoured. So you get these privileged spaces (I have no better word) like "Documents". They've tried to make Explorer as invisible as possible. But they never finished the job! So you end up with a mess of "AppData" (apparently a normal directory) and "Application Data" (not accessible). I presume the first is an alias for the second; but the second should be invisible if it's not accessible (there are other directories like this). This started with Win7. Then they stopped abruptly, but never reverted these aborted changes. It's as if there's nobody in charge. My guess is that forcing Microsoft accounts, "instrumentation", and failed attempts to hegemonize mobile were prioritized over fixing what they'd broken. NT4 was a reasonable OS, with a rotten commandline. Nothing they've shipped since has come close.

squarefoot 4y ago

Give TestDisk a try. Years ago I have been able to use it to recover almost all files from a unreadable disk coming fom a RAID1 mirror gone bonkers due to a faulty controller. https://www.cgsecurity.org/wiki/TestDisk https://www.cgsecurity.org/wiki/TestDisk edit: oh, I just read that you mentioned TestDisk. Yes, it can recover the directory structure, at least it did in my case. After using it you will likely see that some files have been duplicated with a suffix added, like document.doc and document.doc.xyz (can't recall the exact suffix) in the same directory. In that case you need to check which file has been fully recovered, and rename it if needed.

jqbdwst 4y ago
TestDisk is a miraculous tool !
- raffraffraff 4y ago
  TestDisk is cli-only. I decided to have a look at PhotoRec (created by the same folks as TestDisk). It has a handy QT gui. Unfortunately, the only option is to scan the disk for selected file types and dump them all into a chosen location. This loses folder structure, so years of files will all get blended. I'd prefer an undelete option that can target "C:\Users\TEMP\Documents" etc, but this might be asking too much. Gonna try TestDisk next..
  - axiolite 4y ago
    Testdisk is great when you need to recover a whole partition, but not nearly as capable and advanced when it comes to recovering deleted files. You'll do much better with purpose-build Windows undelete utilities. I've had good luck with freeundelete: https://www.officerecovery.com/freeundelete/ https://www.officerecovery.com/freeundelete/
  - sorenjan 4y ago
    Recuva has worked well for me in the past, it has a "Restore folder structure" option in the settings. https://www.ccleaner.com/recuva https://www.ccleaner.com/recuva

pxeboot 4y ago

Temporary profiles have been a feature on Windows for many years. Likely intended as a way to login when a roaming profile isn't available on the network, not something a home user would care about.

anvic 4y ago

[dead]

happytoexplain 4y ago
Since the notification area, like on mobile, tends to become full of garbage, users rightfully do not expect it to be a place where hyper-critical information like this will appear, or at least not using the same format. Further, this wording is inadequate. The vast majority of people would reasonably not understand that dragging your pictures back to the My Pictures folder, where they already were moments ago, is what the message means by "creating files in this profile". Further still, there's no reason for Windows to choose not to behave in a reasonable way in this scenario (e.g. prevent writes to the profile, or show a dialogue when you try to write using Explorer, saying "if you do this, the files will be deleted").
marcosdumay 4y ago
Yeah, that's definitively not enough notification. When you have a similar problem on Linux, and you home is inaccessible or read-only, you get an almost screen-sized dialog, no desktop background (something hard to replicate on your settings), and the system theme (that is probably different from your DE's default).
- jodrellblank 4y ago
  You will on current supported Windows versions as well: https://www.windowsphoneinfo.com/attachments/97fdf7d3-6fca-4a29-92bb-1319b6575bf2-upload-true-png.91063/ https://www.windowsphoneinfo.com/attachments/97fdf7d3-6fca-4... Windows 7 left extended support two and a half years ago, mainstream support seven years ago, and hasn't been in development for eleven years. (Like commenting from Windows XP in 2001 that Windows 3.11 in 1993 had an unhelpful dialog box).
  - userbinator 4y ago
    The picture of the notification there in the original comment is from Windows 10.

somat 4y ago

My condolences, I had a corrupt profile once, I was a bit angry that I could find no way to uncorrupt it. I could find no tools that would fix it. I ended up having to remove the user and create a new one. Thankfully no file loss but the whole process was made harder than it should have been because the only user account on the system was the corrupt one and it refused to log in due to the profile problem. My lessons learned from it. windows profiles are far too complicated, it was hard to find low level information on how they work or how to diagnose and fix a bad profile. make sure you have and know another login. preferably the admin one.

mnahkies 4y ago
My memory is shaky as it's been a while since I used it, but I vaguely remember there being a hidden built-in administrator account that could possibly be used in this situation. Can't remember if you would need to set a password on it / enable it ahead of time though Edit: this might be what you meant by the admin one (rather than a)
sgtaylor5 4y ago
Would this have helped? https://www.sevenforums.com/tutorials/186131-user-profile-service-failed-logon-user-profile-cannot-loaded.html https://www.sevenforums.com/tutorials/186131-user-profile-se...

darepublic 4y ago

I had a resume.json file under my user folder and windows 10 simply won't find it in the search bar. It will find another identically named file on a folder on desktop. I have no idea why it cant find it and I'm sure these is some setting I could look up to ameliorate the problem but I am still blaming windows for this.

layer8 4y ago
For filename-based search, use Everything: https://www.voidtools.com/ https://www.voidtools.com/. It’s much faster and more reliable than Windows search.
- nope96 4y ago
  Wow, I haven't thought about that program for years. I'd thought it was abandoned.
- jtmaher 4y ago
  Another good one is Fast File Finder https://blog.kowalczyk.info/software/fast-file-finder-for-windows/ https://blog.kowalczyk.info/software/fast-file-finder-for-wi.... It's by the same guy who made SumatraPDF.
alpaca128 4y ago
It may just be settings but that's just as inexcusable. If default settings prevent a search feature to find exact filename matches on a system targeted at end users, the default settings are broken. What is so baffling to me is that it's not being fixed. It would be understandable if it only affected power users or if it was a launch-day issue getting patched in the first week. But it isn't.
- lazide 4y ago
  Lately Microsoft has been breaking a lot of bread and butter type stuff. See the recent experiences with Notepad or Voice Recorder for examples.
4y ago

ThrowawayTestr 4y ago

Recuva is a great freeware tool to restore files.

Thaxll 4y ago
Once you have a SSD you can't get back deleted files.
- laborat 4y ago
  Only after the volume has been trimmed, which by default happens only once a week in Windows, IIRC.
  - Thaxll 4y ago
    No, the TRIM happen the moment you delete the file.
    - lazide 4y ago
      Not anymore on windows or Linux. It tends to cause wear issues on many SSDs
      - Thaxll 4y ago
        Well do the test on windows, delete a single file and try to get it back. https://www.youtube.com/watch?v=hzClnwGeJUM https://www.youtube.com/watch?v=hzClnwGeJUM
        lazide 4y ago
        I did a couple months ago to a number of files. Worked fine. Windows 10, all solid state storage.
- ThrowawayTestr 4y ago
  I've recovered deleted files from an SSD before.

dmfdmf 4y ago

Win7 had an occassional timing issue where it would try to start before the profile could be read so it would boot to a temp profile. The main symptom is that all the user's files and desktop icons were gone. I would just have them reboot then it would be fine but it would need a tuneup, chkdsk, delete tmps, etc. as long as the drive wasn't really old. It used to be more common before the move to SSDs instead of HDDs but a Win7 computer's drive is probably really old, so yes, time for a new PC. In this case the deleted files would have to recovered. I recently use Easus Data Recovery Wizard and was able to restore a lot of files for a client who's photo storage drive crashed. It would be best to pull the drive and do the recovery on another computer. I think the free tool allows up to 2GBs of data recovery but in this case the client had 100's of GBs so he paid for a 30 day license for $65.

dataflow 4y ago

Try Recuva, IsoBuster, etc. And take an image before booting the disk.

swayvil 4y ago

Being a Linux user (Debian, Mate), I have never suffered "profile corruption". Or "lost" a file that I recall. Is this a normal thing in Windows?

deleted 4y ago
[deleted]
guilhas 4y ago
I have lost, dd'ing the main disk/partition by accident while creating boot usbs, several times
- swayvil 4y ago
  That is definitely a way to do it. DDing is scary to me.
RedShift1 4y ago
Just because it didn't happen to you, doesn't mean it didn't happen to anybody else. I got hit by the ext4 empty-files-after-crash that corrupted my KDE profile back in the day.

brudgers 4y ago

It sucks to lose files. Not having a backup is a platform agnostic way to lose files, and works pretty reliably given sufficient time. Windows 8 came out in 2008.

2143 4y ago
> Windows 8 came out in 2008. Typo; you meant to say 2012.

nazgulsenpai 4y ago

Not that this fixes your immediate problem but just an FYI for anyone who might be in a similar situation in the future, in the 10+ years I've been in IT I've used the free ForensIT Profwiz, Transwiz and Defprof for any of these weird profile issues with success. Not affiliated in any way, just a sporadic user. https://www.forensit.com/ https://www.forensit.com/

lillecarl 4y ago
Back when I did Windows work I used their tools too, great quality!

hulitu 4y ago

Never ever store valuable files on those "virtual folders" on Windows: My Documents, My Pictures etc. Avoid storing valuable files in the user profile. Windows will get confused and you might lose data. This is especially true if you use a local language in windows.

navjack27 4y ago
Yeah don't store things in those virtual folders... Store them in c:\users\username\documents instead. Much safer.
- fuzzfactor 4y ago
  People often forget what the transition was like from office machines, manual spreadsheets, and filing cabinets to having a single PC that could replace these for you if you really try. But you really have to try and put in some effort here. Without taking action to have it your way, you'll be left to the default approach which Microsoft has molded for users who may never grasp filing systems at all, which is simultaneously backward-compatible with DOS. And then third-party software which sometimes tries to better cope by having their own layer of obscurity which can help your workflow but the filing can end up even more ugly. But the filing cabinet never was an office machine anyway, and as far as automatic, I would much rather have a real intelligent secretary file & retrieve my folders than I would a machine. And without a secretary I figure I'm going to have to put in some effort my dang self, and get the most out of the electronic filing at my fingertips. The C: volume containing DOS or Windows was subject to the most frequent defects or corruption and could be considered the most risky place to put any of your valuable data if you could help it. But regular PCs for office or home were supplied with only one partition on their HDD so there was no separate volume that could be dedicated exclusively for storage. The highest-reliablity upgrade was having a second hard drive dedicated for storage, but naturally you had to work from a blank slate and label all the folders yourself just like a secretary would do. Further you need to be very vigilant and direct any valuable data from all Windows or third-party apps to your dedicated folders every time. However nobody actually needed this drive space at the beginning since that's when there's always plenty of room on C:. But it was worth it. Be your own secretary. Yes the C: drive was still a PITA to restore but it was good to maintain readiness to Format C: at any time without losing any valuable data at all. Then restoring only the system (Windows, installed apps, and settings) quickly from backup, or alternatively reinstalling them in the previously optimized repeatable full recovery procedure. Always install programs to C: right along with Windows. To a newer, faster, or bigger HDD whenever you felt like it. The C: drive was like the office machine substitute, where you need to be able to change some of the things on your desktop or even get a whole new desk from time to time, but you wouldn't want to handle your company files and their filing system as disposably as you would a broken office machine. And the second HDD volume was the filing cabinet substitute, which could physically be moved or copied and placed into a different office without affecting the desk or desktop that generated the data. Now this was before the Documents And Settings folder appeared. Which pushed the mainstream in the opposite direction, placing your valuable data by default into folders automatically labeled and tucked away largely within deeply nested trees within Windows' increasing number of self-created folders, and completely downplaying any underlying need to know the filing system at all. Instead of all being in one filing cabinet, your data became a "part" of Windows and it became acceptable for your files to be less accessible to your fingertips alone. Not without Windows and each App in question being there in perfect working order. And with temporary files from the internet growing right there in the same folders, rendering your relatively small number of useful business files more like a needle in a haystack as time goes by. Is this risk really worth it just to have the simplified option of multiple users in offices where everyone needs their own Personal Computer to begin with? Anyway they basically call it the Users folder now and you've got a symbolic link from Documents And Settings, so the woods got deeper that time too. I hate having to knock down more trees just to get stuff done. Even when paperwork has been my only product so much of the time. With effective multi-partitioning it became within reach to have separate volumes for Windows vs. Your Data, when you only have a single HDD. You do have to take action from there. Which is a step in the right direction but with fast external USB drives it's one of the best ways to physically separate your personal filing cabinet from your office/machines again. Plus externally store your well-tested working backups of Windows' less-sizable full C: volume itself as .WIM files, to hammer a reformatted C: often with, which can be quicker than defragmenting with about the same outcome if you do it right. Losing a laptop doesn't have to be so bad if there are no credentials or company data on board to begin with, but as always don't leave your stuffed filing cabinet in your competitor's reception area. Especially if it fits in between the couch cushions.

actionfromafar 4y ago

I once recovered most of my pictures with https://sleuthkit.org/ https://sleuthkit.org/

EVa5I7bHFq9mnYK 4y ago

Sorry, a tangential question ... my friend's 2011 Macbook Air's hard drive gave up and she has all of her photos there. The Macbook doesn't boot, just shows a white screen. Can the photos be salvaged somehow?

hunter-gatherer 4y ago
I'm not sure off the top of my head if MacOS was encrypting the drive at that time, but you might try plugging the drive into FTK Imager or Autopsy. I believe both of these tools will do some data carving. But before you do that, make sure the issue isn't the hard drive itself. If the hard drive is damaged, you may still be able to recover data, but it'll need to be done by someone who knows what they are doing. If the drive is spinning irregularly, or clicking, or not recognized by another system you might have issues. Source - I used to work in a digital forensics lab.
- EVa5I7bHFq9mnYK 4y ago
  thank you!
- netsharc 4y ago
  Wow, my guess was since it was 2011, they would've still been using an old-fashioned spinning disk or probably an SSD with that form factor and normal SATA connection, but they were already using M.2 SSD, but a Frankenstein one where an adapter is needed: https://d3nevzfk7ii3be.cloudfront.net/igi/n4Fo16YKi45Y5JxL.full https://d3nevzfk7ii3be.cloudfront.net/igi/n4Fo16YKi45Y5JxL.f... Source: https://www.ifixit.com/Guide/MacBook+Air+11-Inch+Mid+2011+Solid-State+Drive+Replacement/6317 https://www.ifixit.com/Guide/MacBook+Air+11-Inch+Mid+2011+So...
  - hunter-gatherer 4y ago
    That is surprising! I also assumed that being a 2011 it would be a spinning disk drive.
    - 4y ago

signaru 4y ago

This is why my work documents and data are always on a second drive (or partition if hardware is limited). I haven't used the default Windows folders for years and it's only some software creating folders under "My Documents" that I just ignore. You never know when you'll have to reformat the main Windows drive. It also proved convenient when I changed computers as I just plugged in the data drive I had always been using, and all my familiar documents are there. Of course, there's also the cloud to backup the more important stuff.

dsego 4y ago
That's why on linux you can mount your home directory to a separate partition. You can reinstall the OS but still keep all your files and settings intact. And even better, it's the default location like "My Documents" so the OS and apps know where to look for things.

jhoechtl 4y ago

Well the mistake was to move files first place. Should have done a copy first, check if everything is ok and then delete.

raffraffraff 4y ago
You're right of course, but this is a man in his 70s who didn't want to bother me again to fix his old laptop.
iudqnolq 4y ago
Huh? Assuming they was actually no warning, I doubt any of us would reboot before the check in that sort of process.

WalterBright 4y ago

> This wasn't obvious to the user because Explorer hides the 'detail' of the file path and simply shows the username I really really dislike Windows when it hides paths, for example, "My Pictures". Where the heck is that? This lunacy infects Windows applications, like Quicken and Thunderbird, which spew themselves and their data into gawd knows where hidden directories. Why can't they simply do the obvious? Create a \Quicken directory in the root, and have a \Quicken\program and \Quicken\userdata ? But noooo.

mananaysiempre 4y ago
> Why can't [Quicken and other Windows apps] simply do the obvious? Create a \Quicken directory in the root, and have a \Quicken\program and \Quicken\userdata ? Networked machines. (Aside from the obvious security problems on a multi-user installation.) The "gawd knows where hidden directories" (of which there are two, %APPDATA% and %LOCALAPPDATA%, plus, on a recent Windows version, a number of compatibility links and some sort of integrity level thing) are segregated into the part which should have an authoritative copy on the file server ("roaming") and the part that can or has to stay on the workstation ("local").
- carrolldunham 4y ago
  I can't believe windows doesn't offer an option "this is my laptop, nobody else is ever going to use it". I hate logging in to my own laptop and having a user folder like some loser student in a library
  - navjack27 4y ago
    Every OS is like this... Except Haiku. And you aren't the only user on pretty much every OS. There are many many many built in "users" for different internal operations.
    - smaudet 4y ago
      Not relevant. Every OS also has different levels of user. Your user should be the admin, shouldn't be tied a profile etc. Linux is setup like more like this. Yeah, it makes it more complex for certain network style things (you have 4 computers and want to sync between them), but it's trivial to work around. The reason Windows is built like this is they develop first for enterprises and libraries, everyone else gets the shitty castoffs...

ComodoHacker 4y ago

> Windows would drop them into a temporary user profile without dire warnings about its transience. I'm sure there was some warning. But you know, users don't read messages...

Dwedit 4y ago

Just don't use your user profile directory at all. If you really want to, replace the directories with Junction Points that point elsewhere. Then if your User Profile gets deleted, nothing will happen to the files.

userbinator 4y ago
If you really want to, replace the directories with Junction Points that point elsewhere. After https://news.ycombinator.com/item?id=18189139 https://news.ycombinator.com/item?id=18189139 , I don't think I want the OS to know where else I'm storing my files.

angry_octet 4y ago

This unfortunately highlights a key forensics requirement: don't touch the computer. Don't turn it on, don't turn it off, don't login/logout. Ideally keep the wifi router turned on, but disconnect it from upstream internet. It's very hard to get people to follow this of course but it's critical, especially now FDE is becoming more common. In the extreme case you can leave it on until you can cause an exploit remotely or are ready to immerse it in liquid nitrogen and extract the FDE keys from RAM. There are tools (wiebetech.com) for moving plugged in computers onto battery power if you can't work in situ or can't risk a grid outage.

DerekBickerton 4y ago
This. To be honest, I think it's a miracle that my machine boots at all. Most people take it for granted, but I cherish each day it boots and I don't have to do a clean install because something breaks (typically some bizarre edge case scenario unique to Windows that only breaks on my machine). There is the old saying: if it works, don't try to fix it.
autoexec 4y ago
> It's very hard to get people to follow this of course but it's critical We've spent decades telling users that the miracle fix for all their technology problems is turning your device off and on again. That's going to a long time to undo.
discardedrefuse 4y ago
You can't ask people to treat every "user can't find file" situation as a forensic investigation.
- angry_octet 4y ago
  This is easy to triage! Q1 - Would you be very very upset if all the data on your computer was lost Y/N Q2 - Do you have backups of this data? (The answer is invariably No.) Q3 - Is your computer behaving strangely? Do you have a spidey sense of doom which caused you to contact me? Y/N At which point it should be clear that further unqualified FA&FO is a bad idea.

seqizz 4y ago

I recovered a lot with RMF, not sure if it still has the vibe though, that was a decade ago. [link] https://getdata.com/recovermyfiles/ https://getdata.com/recovermyfiles/

rejectfinite 4y ago

>I was frankly astonished that Windows would drop them into a temporary user profile without dire warnings about its transience. There is warnings... Now the Win7 one is just the notification baloon and easy to miss but the 10 one is pretty "in your face" Windows 7: https://imgur.com/a/ao5AtO6 https://imgur.com/a/ao5AtO6 Windows 10: https://imgur.com/a/Hl9XnZV https://imgur.com/a/Hl9XnZV

mrtksn 4y ago
Too long and too verbose and too ordinary for such an critical warning. The title "You have been logged on with a temporary profile." is so unoffencive that doesn't really make you read the paragraph explaining what it means. It sounds like something that you can deal with later, it should be "All files will be deleted upon sign out" and then you can read and learn that this is a temporary profile. Windows likes to tell stuff of no urgency all the time and people will close those click. click. click. IMHO when the computer is used in extraordinary situation the UI should be making it very clear. Probably all kind of customisation should be removed so the user feel like in wrong place and has high alertness. When moving files into folders that will be deleted the user should be warned with a short and scary message(macOS warns you that the files will be deleted from the cloud if you move files out of iCloud synced folders like Desktop and Documents).
- naikrovek 4y ago
  guess what? all customization is removed, because that configuration is stored in the user profile.
  - mrtksn 4y ago
    Good point but just in case if the user has not been using a customised UI, maybe everything should look non-default and out of place. If I remember correctly, the system defaults to a low resolution when something goes wrong and this may help. The point is, the user should be made aware that this is not business as usual and proceed with extreme caution. A popup with cryptic title and long paragraph won't do it.

fortran77 4y ago

There really shouldn't be any problem! Disk drives on any operating system can fail at any time. All they have to do is simply restore from their backups. Shame on Hacker News for doing this juvenile "Mico$oft WINDOWS BAD" crap. It's boring and stupid.

whywhywhywhy 4y ago

>(This wasn't obvious to the user because Explorer hides the 'detail' of the file path and simply shows the username) I hate how Explorer tries to be clever with the Documents etc folders but it just makes it obtuse. Like if I open Documents from the side bar and press Up Directory I end up in My Computer not my home folder.

naikrovek 4y ago

> frankly astonished that Windows would drop them into a temporary user profile without dire warnings about its transience. windows didn't drop them into a temporary user profile; the user did that. windows assumes that you know what you're doing when you move files around. everyone loses their minds when it doesn't make this assumption.

detaro 4y ago
How did the user actively drop themselves into a temporary user profile?
- unnouinceput 4y ago
  You'd be amazed how people just drag'n'drop stuff they don't understand, and given that in Windows you're the "root" (Administrator) all the time, then you can guess how easy was that.
  - detaro 4y ago
    that's clearly not what the original line meant by "drop into".
- naikrovek 4y ago
  the user dropped the FILES into a temporary user profile. Windows tells you when it logs you into a temporary user profile. it doesn't do that silently.

aabbcc1241 4y ago

Back in the day when I used windows, there is a tool "Recuva"[1] that scan the harddisk to recover deleted files. As long as the block on harddisk is not overwritten by new content, it can restore the deleted files. [1] https://www.ccleaner.com/recuva https://www.ccleaner.com/recuva

glitchc 4y ago

Check out PhotoRec: https://www.cgsecurity.org/wiki/PhotoRec https://www.cgsecurity.org/wiki/PhotoRec

fuzzfactor 4y ago

Try DMDE.

ck2 4y ago

Buy them an 8TB external hard drive for $150 Tell them to flip it on once a week if not more often. Press the backup button. Turn it off when done. Now they have the ultimate offline backup for a full restore regardless of corruption, virus, hacked, etc.

1970-01-01 4y ago

3 failures here: Windows - 1) Automatically forced a temporary profile creation instead of asking to do so. 2) Forced automatic temp profile alert was too small and quiet, so the end-user simply ignored it. User- 3) No backups.

phendrenad2 4y ago

This is probably such a rare event, your relative might have been the only person in history to do this. So I'm not exactly impressed by the "badness" here.

navjack27 4y ago

How do so many people commenting on this seem to universally agree about being confused by Windows file structure? Like, look https://learn.microsoft.com/en-us/windows/deployment/usmt/usmt-recognized-environment-variables https://learn.microsoft.com/en-us/windows/deployment/usmt/us... Those are the path variables Ez But logically? How hard is c:\users\username\whatever? Are you all so so so into Linux that you are just utterly flabbergasted by the simplicity of Windows? All operating systems hide hidden paths also. You can enable showing hidden paths. You should just know where programdata is where appdata is... The difference between local and roaming and locallow... I mean cmon nerds! Get with it! On Linux or Mac. Tell me. Where is Documents? Where is Pictures? Where is applications? Is Documents in ~/Home/Documents? Where is that if I'm not the current user? Why is Applications on Mac in my home folder different than the Applications in Macintosh HD/Applications? Why can I Macintosh HD/Volumes/Macintosh HD/Volumes/? Windows is somehow the insane one? Windows makes sense! Instead of all agreeing that you're confused by something that you should be an expert in at this point if you are working in the computer space at all... Maybe you should take some time out to actually brush up on some skills that could be useful that you could help family members with. Because bitching around the sewing circle isn't going to inspire confidence and it's not going to help your case in any sort of way that you would think if you actually want to change or improve the situation of file system hierarchy. Remember, we are the nerds that know everything! Act like it! If Windows is so beneath you; then master it completely! Don't just ignore it because you think you're so much better than it. I see so many comments and threads on hacker News constantly where people are just like "I haven't touched windows in 15 years and then I had to touch it last week and oh my God this and that and this and that." And to me that is just the sign of someone who gave up.

geocrasher 4y ago
This. So. Much. This.
tuatoru 4y ago
> How hard is c:\users\username\whatever? Not hard at all. But Windows really, really goes out of its way to fight me using that. > You can enable showing hidden paths. You should just know where programdata is where appdata is... Yeah, because the onboarding tutorial for new accounts explains all that. Not. Some of us do know this stuff, and we can sort of understand why Microsoft made the decisions they did (they make sense, or at least less nonsense, in large corporate environments of Word users). But they are still a nasty product of the "reach for abstraction" impulse of programmers with not enough experience to know that they're working outside their zone of mastery.

albert_e 4y ago

temporary profile can access files belonging to a different profile that the user was unable to log into ? and move / effectively delete them all? why does a temporary profile have such privileges

sedawk 4y ago

I might have some recommendations, please reach out to me if you're still struggling to recover the files

Sakos 4y ago

I think the actual issue is that the files showed up in the search, allowing the user to do something that would lead to disastrous consequences. How did that happen from a temporary profile? Why does that temporary profile have access rights to the previous profile? Also, I'm not entirely certain that Windows automatically deletes temporary profiles.

animal531 4y ago

A long time ago at one of my first jobs we had a guy who stored his files in the Recycle Bin, when asked why he indicated that he liked the icon. Of course the bin eventually recycled his files which led to him finally reaching out for help.

eitland 4y ago

Have you recovered them yet? As long as they are just "deleted" and not overwritten, file recovery on Windows used to be easy.

Razengan 4y ago

@HN/Damg: How the hell are we supposed all that text by OP if it’s deliberately faded out? Gray on beige, really? Do we have to wait for YOUR eyesight to worsen before you realize some basic usability?

CrazyIvan 4y ago

GetDataBack for NTFS with full scan should be able to recover files.