recovering shadow copies through testdisk

[hmmthatssomething]

Hello, I am new to recovering files. A month and a week before, I lost all my bookmarks and worse I even overwritten the file. I can't use system recovery because the restore point is already overwritten as well. I have found out about shadow copies however and I've heard that they get deleted, not overwritten. My question is, can I use testdisk to recover shadow copies in general? Can I make testdisk go to the specific folder (which I asume is C:/ Volume Information Folder.) and get back the file that would give me a shadow copy on anything before April 14th? (day I lost them through the browser crashing). I also wonder if there is any way to recover previous shadow copies at all? All help and advice is appreciated

[recuperation]

Hello, I am new to recovering files. A month and a week before, I lost all my bookmarks and worse I even overwritten the file. I can't use system recovery because the restore point is already overwritten as well. I have found out about shadow copies however and I've heard that they get deleted, not overwritten. My question is, can I use testdisk to recover shadow copies in general?

Shadow copies are not listed here as a feature:
https://www.cgsecurity.org/wiki/TestDisk

Can I make testdisk go to the specific folder (which I asume is C:/ Volume Information Folder.) and get back the file that would give me a shadow copy on anything before April 14th? (day I lost them through the browser crashing).

You can try that out and post your result here.

I also wonder if there is any way to recover previous shadow copies at all?

I guess so, but if you are deleting or overwriting restore points you might be left with data without metadata.

[hmmthatssomething]

How can I make Testdisk go only to the "C:/Volume Information Folder"? Are there any risks to trying to recover these types of files? These files I see here in the folder are just called "System Files" or .sys, can these system files be recovered in anyway possible? Is there any other programs that can recover these types of files aswell? How do I make sure I am not overwriting the files as I try to recover them? Sorry for the amount of questions, these bookmarks are just very important to me. Also, my computer is running on Windows 10, if that helps.

[recuperation]

How can I make Testdisk go only to the "C:/Volume Information Folder"?

If Testdisk is recognizing a file system, you can browse the folders and files inside. See function "list files":
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

Are there any risks to trying to recover these types of files?

If you do not write to the file system in question and your disk is not dammaged there is no risk. You generally prevent risk by duplicating your disk as described in the manual using ddrescue.

These files I see here

I can't see where "here" is.

in the folder are just called "System Files" or .sys, can these system files be recovered in anyway possible?

There is no difference between system files and any other file when being browsed by Testdisk.

Is there any other programs that can recover these types of files aswell?

I don't know. Basically you are not on file recovery level anymore. You are searching something to repair or rebuild data stored by the application VSS. This is as difficult or specific as to recovering content from Excel or Word files or any other application. And every solution is specific with regards to the file format used.

How do I make sure I am not overwriting the files as I try to recover them?

By chosing the right target location for recovery.

Sorry for the amount of questions, these bookmarks are just very important to me. Also, my computer is running on Windows 10, if that helps.

As your questions all boil down to "How do I use Testdisk?" I strongly recommend you trying out Testdisk in a safe environment and getting familiar with it. Set up a second computer with just an operating system installed, connect a disk that you want to examine whose content you might loose without any consequences.

I read that VSS is block-oriented, not file-oriented. If that is right you might not find complete labeled files as you are hoping for.

Please post a follow-up if you succed somehow.

[hmmthatssomething]

I don't have a second computer to get used to it sadly.

I can acess the System Volume Information through the "list files" feature but it shows the files I have, no deleted files.

I am going through the undelete page of testdisk_win file (version 7.2) and I can only find files related to the apps I use and the files being very recent, nothing related to the System Volume Information.

Is there a way to go deeper into the system's deleted files? Should I have made a "deeper search" before? I have tried to do a deep search a few days before while following this video: https://www.youtube.com/watch?v=-7FtaQeJg0k

[recuperation]

I don't have a second computer to get used to it sadly.

I can acess the System Volume Information through the "list files" feature but it shows the files I have, no deleted files.

I am going through the undelete page of testdisk_win file (version 7.2) and I can only find files related to the apps I use and the files being very recent, nothing related to the System Volume Information.

Is there a way to go deeper into the system's deleted files? Should I have made a "deeper search" before?

Read the manual:
https://www.cgsecurity.org/testdisk.pdf
Read the online documentation:
https://www.cgsecurity.org/wiki/Undelet ... h_TestDisk

I have tried to do a deep search a few days before while following this video: https://www.youtube.com/watch?v=-7FtaQeJg0k

For third party video support, please contact the third party.

If there is any file to find at all, it has been probably trimmed or overwritten.

[hmmthatssomething]

I don't have a second computer to get used to it sadly.

I can acess the System Volume Information through the "list files" feature but it shows the files I have, no deleted files.

I am going through the undelete page of testdisk_win file (version 7.2) and I can only find files related to the apps I use and the files being very recent, nothing related to the System Volume Information.

Is there a way to go deeper into the system's deleted files? Should I have made a "deeper search" before?

Read the manual:
https://www.cgsecurity.org/testdisk.pdf
Read the online documentation:
https://www.cgsecurity.org/wiki/Undelet ... h_TestDisk

I have tried to do a deep search a few days before while following this video: https://www.youtube.com/watch?v=-7FtaQeJg0k

For third party video support, please contact the third party.

If there is any file to find at all, it has been probably trimmed or overwritten.

So, there is a extremely unlikley chance that I could recover my old bookmarks then? That it would be impossible to recover previous shadow copies or system restore points?

[recuperation]

So, there is a extremely unlikley chance that I could recover my old bookmarks then? That it would be impossible to recover previous shadow copies or system restore points?

You do not provide a case description. Any judgment by me would be outright ridiculous.

[hmmthatssomething]

So, there is a extremely unlikley chance that I could recover my old bookmarks then? That it would be impossible to recover previous shadow copies or system restore points?

You do not provide a case description. Any judgment by me would be outright ridiculous.

Sorry, I'm just worried about doing it wrong. So, since shadow copies are hard to get back and there is a very possible chance that it is already far gone. What are my best options to work with these massive obstacles using TestDisk (or PhotoRec aswell). I am still very confused on what files does TestDisk actually recover... I have done a quick search and deeper search before, would that affect what files TestDisk can recover? I only see very recent files, I have copied some files that were before this month but I don't think I can do anything with them. Now I only see files on this month...

Also, about PhotoRec, can it also recover computer files (like .sys) or is it only meant for media files (like .txt, .swf, .doc, etc)?

[recuperation]

So, there is a extremely unlikley chance that I could recover my old bookmarks then? That it would be impossible to recover previous shadow copies or system restore points?

You do not provide a case description. Any judgment by me would be outright ridiculous.

Sorry, I'm just worried about doing it wrong. So, since shadow copies are hard to get back and there is a very possible chance that it is already far gone. What are my best options to work with these massive obstacles using TestDisk (or PhotoRec aswell).

Unfortunately you are completely ignoring my first answer:
viewtopic.php?p=37321#p37321

I am still very confused on what files does TestDisk actually recover...

You will be less confused if you take your time to read the online documentation and the manual. There are lots of ressources out there. Sometimes complete reading is not necessary, cross-reading and searching for keywords will be sufficient.

I have done a quick search and deeper search before, would that affect what files TestDisk can recover?

Read the manual:
https://www.cgsecurity.org/testdisk.pdf

I only see very recent files, I have copied some files that were before this month but I don't think I can do anything with them. Now I only see files on this month...

I can't see what and where you found something.

Also, about PhotoRec, can it also recover computer files (like .sys) or is it only meant for media files (like .txt, .swf, .doc, etc)?

I am sorry to repeat myself, but would you be so kind as to read the manual?
https://www.cgsecurity.org/testdisk.pdf
I guess that would solve many of your questions!

The manual has a table of contents and by clicking onto the chapter and sub-chapter titles your PDF reader should show you the relevant content.
Could you imagine how all the people feel that contributed to the manual and the extensive documentation on this website when they notice that you don't want to read it?

The best way to find out if Testdisk or Photorec could be helpful to solve your problem is to run the Testdisk package on another machine where VSS is up and running and no restore point has been deleted. If you don't succeed on a machine where nothing has been deleted you should not bother trying searching on your machine.