Win 8: Files vanished after login password reset

  Gorguruga 18:25 16 Mar 2015

Bit of a strange issue here - someone got fired from work and changed the password on the Windows 8 computer before they left. I just managed to reset the password yesterday but now the Outlook account has none of their previous emails and the One Drive account files seem to have all gone missing and certain files that were on the C: Drive are all gone and not in recycle bin either.

When I reset the password I noticed there were three accounts on the computer - USER (which is the one I reset since it was the default when starting up computer), ADMINISTRATOR (didn't touch this one) and GUEST (didn't touch this either).

AfterI reset the password, I'm pretty sure it was the right one as there were still a few relevant files still on the desktop. It's just everything else seems to have vanished.

When I search for certain files in the Explorer, file names come up but it says that "the file location has now been changed" so the shortcut doesn't work.

  robin_x 19:32 16 Mar 2015

Have a look at Easeus Data Recovery and also Recuva.

Don't use the computer with missing files because you risk overwriting the now unallocated space.

You'll need to read the licensing restrictions since you are a business.

I guess you already realise you should have a proper backup strategy.

Good luck

  Gorguruga 20:03 16 Mar 2015

robin_x, thanks for the response. Is there a way to tell if the files have been deleted by going through the Event Log Viewer (I've tried looking in there but not sure what I should be looking for) - also not sure if files have been deleted or if somehow the password reset did something?

  robin_x 20:16 16 Mar 2015

I've never found the inclination to get to grips with Event Viewer I'm afraid.

Changing passwords should not have messed up the files.

I suppose you could try a System Restore to before the problem, in case some settings are broken and causing problems

Search Create a Restore Point which leads to System Restore.

It won't recreate missing files (or delete newer files made after Restore Point Date)

Just Windows settinggs

  Fruit Bat /\0/\ 20:30 16 Mar 2015

Have you changed the user name?

  Gorguruga 20:47 16 Mar 2015

I didn't change the username BUT I think the username used to be different before - it just says "USER" now - and this is how it was when I got it handed over to try to reset the password... but before I think it was the person's name which appeared as the logon Name - since they left it now just says "USER".

  Fruit Bat /\0/\ 22:20 16 Mar 2015

They have deleted their account.

You will need to run recovery software as suggested by robin x

do not write too mucch to the drive as it will overwrite waht is there make sur the recoery software save the recovered files to an external drive to avoid overwriting.

  Gorguruga 23:00 16 Mar 2015

FruitBat, thanks for the info - is there a way for me to check for sure that the account has been deleted (through the Event Viewer or something?)

The reason is that I need to show to colleagues that it's definitely been deleted.

Also I started doing recovery now.. I notice a large file(1GB in size) with a file extension .tmp - do you have any idea what this might be?

  robin_x 23:50 16 Mar 2015

.tmp is a temporary file for storage of data.


Have a look in c:\users for anything that looks like the previous users profile folders.

Even if an account is deleted, I'm not sure when the folders do.

I have a PC-User2 account that was made automatically for me when I made a mistake during a reinstall. I deleted it, but folders are still there.

  Gorguruga 10:20 17 Mar 2015

thanks for the info Robin_x

I'll check the folders when I get to work later. I'm still wondering if there's a way to tell if a User has deleted an account through the event viewer.

I sort of want to take the heat off myself to be honest because they are wondering if after resetting the password I caused the data to go missing. I'm sure that didn't happen but I'd like to show that the User Account and info was deleted etc..

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Alienware 17 R4 2017 review

Is this the future of VR and AR?

Best iPad buying guide 2017

Comment regarder le Bureau des L├ęgendes en ligne ?