Expert for data recovery needed

[FergusMarcErickson]

This is a paid gig for a customer of mine. Host system is Windows 7 Pro x64. Guest is Windows XP Pro. File recovery is needed for WordStar files running through a command prompt - and Quicken files. User is a man in his 70s with dyslexia and some aphasia. Contact me for further info.

[mpack]

What exactly is the problem, I assume something wrong with the XP VM's virtual drive?

Have you tried the "Repair" function in my CloneVDI tool?

Regarding "paid gig", I doubt you will find anyone better qualified than me. However I'm not interested in your money, nor in doing this by PM. Let's just have the details here.

[FergusMarcErickson]

All his WordStar files are missing. He was running WordStar in a command prompt in this WinXP VM (I think). There doesn't seem to be any files there when searching for .ws* files using Windows XP search with hidden and system files showing.

I haven't tried your tool's repair function.

[mpack]

That doesn't sound like corruption. Corruption doesn't leave you with a bootable OS, and only a specific set of files missing. In this case the CloneVDI repair function will not help, because there is nothing to repair.

What that sounds like is that he's been using snapshots, and that opens up a number of different possibilities.

Primary: have you recently try to recreate this VM from a backup or move the VM to a new PC? If so then you should have restored/moved the entire VM folder, not just create a new VM around the first VDI. Howto: Move a VM (restoring from a backup is just a special case of moving a VM).

Secondary: if someone was using snapshots and reverted to an earlier state then everything created since that earlier state would be lost. Only a backup would help.

What do you have by way of backups?

[FergusMarcErickson]

He has no backups. As of now, he considers all of his WordStar and Quicken files lost.

Primary: He hasn't tried to recreate the VM from a backup or move it to a new PC.

Secondary: He thinks that he hasn't made any snapshots of the VM. Any snapshots would only exist if they were done automatically by the VirtualBox software.

VirtualBox was installed and configured for him by a technician who worked at the store where he bought the PC. If it's possible to configure VirtualBox to automatically take snapshots and the technician configured it that way, then a snapshot or snapshots exist.

[mpack]

VirtualBox does not create snapshots automatically, nor does a feature exist in the software that allows them to be created automatically. Nor can I think of a reason why anyone would write an external script to tell VBoxManage to create snapshots, because all that would do is eventually fill the host drive with them.

But there's no need to speculate: if you look in the VM folder you will see the .vbox file, the main .vdi file, and subfolders "Logs" and perhaps also "Snapshots". The latter folder will exist only if snapshots or saved states have been used in the past. If the latter folder exists then look inside. Any VDI files in that folder are snapshot related disk images, snapshots that still exist.

We seem to be quickly running out of options. There does not seem to be any corruption. We believe the user did nothing to disturb the data (e.g. moving the VM using improper methods). Snapshots don't seem to have been used. The only thing you have asserted is that certain data files are missing. In that case the only scenario I can see that fits is: user deleted files or folders.

[mpack]

One thing: I don't trust Windows XP search. It would be far better if the user knew what folder the files were stored in, then you could simply go look.

Or, is it possible to load WordStar still (and if not, how come?) and check what the default path is for saving files.