Failed System Restore
We had a laptop dropped off by a user who said that they had used the System Restore in Windows and had rolled back 2 years, rather than months but had also forgotten the password for getting back into the machine.
Using one of our linux based tools, we reset the password on the machine and duly booted it up to discover the machine had actually been restored to its factory default state ! No documents, no logins, and a huge amount of updates to install.
We removed the hard drive and ran it through some data recovery tools, and managed to find a good chunk of data that had not been overwritten when the system was restored to its factory state which was duly copied off to a memory stick.
Leaving the machine for 24 hours to do a deep scan of the hard disk,we managed to recover a few more missing files, however some of these had been partial overwritten when the system restored.
Another 24 hours for letting the machine re-install all the Windows and Office updates since 2009 and the machine was returned to its owner.
Luckily the files that were essential and involved many years research, seemed to have recovered okay, however there were many photos and documents that whilst having restored okay, were actually unusable.
We think that in this case, the user had mistakenly used the option to recover the system that was displayed before Windows had loaded. In this case, this option restored the system back to its factory default state, overwriting the system already installed, which included all of the user data.
