recovering shadow copies through testdisk

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
hmmthatssomething
Posts: 6
Joined: 19 May 2023, 00:13

Re: recovering shadow copies through testdisk

#11 Post by hmmthatssomething »

recuperation wrote: 20 May 2023, 20:57
hmmthatssomething wrote: 20 May 2023, 16:13
recuperation wrote: 20 May 2023, 15:52
You do not provide a case description. Any judgment by me would be outright ridiculous.
Sorry, I'm just worried about doing it wrong. So, since shadow copies are hard to get back and there is a very possible chance that it is already far gone. What are my best options to work with these massive obstacles using TestDisk (or PhotoRec aswell).
Unfortunately you are completely ignoring my first answer:
viewtopic.php?p=37321#p37321
I am still very confused on what files does TestDisk actually recover...
You will be less confused if you take your time to read the online documentation and the manual. There are lots of ressources out there. Sometimes complete reading is not necessary, cross-reading and searching for keywords will be sufficient.
I have done a quick search and deeper search before, would that affect what files TestDisk can recover?
Read the manual:
https://www.cgsecurity.org/testdisk.pdf
I only see very recent files, I have copied some files that were before this month but I don't think I can do anything with them. Now I only see files on this month...
I can't see what and where you found something.
Also, about PhotoRec, can it also recover computer files (like .sys) or is it only meant for media files (like .txt, .swf, .doc, etc)?
I am sorry to repeat myself, but would you be so kind as to read the manual?
https://www.cgsecurity.org/testdisk.pdf
I guess that would solve many of your questions!

The manual has a table of contents and by clicking onto the chapter and sub-chapter titles your PDF reader should show you the relevant content.
Could you imagine how all the people feel that contributed to the manual and the extensive documentation on this website when they notice that you don't want to read it?

The best way to find out if Testdisk or Photorec could be helpful to solve your problem is to run the Testdisk package on another machine where VSS is up and running and no restore point has been deleted. If you don't succeed on a machine where nothing has been deleted you should not bother trying searching on your machine.
First of all, I apologize if I was being rude or was annoying you. I have looked through the manual and read a bit more about VSS copies and I've come to the depressing conclusion that it wouldn't work. You are right, these files would overwritten in a day and get rid of the oldest one forever :(

I have found however that I can save these shadow copy files from C/: Volume Information Folder by using TestDisk "List files" option and can copy those files to somewhere else, probably safe. I think that is the closest you can get to recovery, just having them already and then copying them to a safe spot.

Thank you for the assisstance and advice on this kind of stuff, I appericate it all. :D

Locked