Data Recovery Question

[dafoe]

I still have no idea how this happened. I hardly ever check my email let alone open any of it- 99% spam. Haven't opened any email in almost a week. And I as sure as hell would never open an email attachment. I haven't downloaded anything in days and I don't use any P2P. But somehow I got the Lovletter Virus. It overwrites all jpg files and replaces them with .vbs files

I cleaned out the virus. I would like to get some, if not all of the jpgs back. I am not that familiar with data recovery. Is this possible with decent data recovery software? I downloaded a couple oif demos but didn't really have any luck.

Any advice would be greatly appreciated.

Thanks.

[Caple]

Try File Scavanger. It saved me once.
I'm not sure if it'll work in this case. But you could give it a try.

[BJ_M]

The Love Bug infects files with the following extensions: "vbs", "vbe", "js", "jse", "css", "wsh", "sct", "hta", "jpg", "jpeg", "mp3", or "mp2". Except for "mp3" and "mp2" files, the virus overwrites the whole file with its virus code and the original file is destroyed.


http://www.pchell.com/virus/loveletter.shtml

[Bjs]

Avgfree , install , update , scan first ...

Drive rescue ... freeware ... if it cannot get file's back , then no other program will .

Problem will be determining original from old infected ... though if you do pull a file that is infected , avg should snap the bugger before anything can happen .

It work's .

Ps : read the documentation that come's with drive rescue to determine the correct function you need to use when recovering file's ...

[BJ_M]

the original file is destroyed - you cant get it back

[dafoe]

the original file is destroyed - you cant get it back

Don't take this the wrong way. I appreciate the help and I am not questioning you. But I am a little confused.

I know the virus overwrites the data. But I was under the impression that data needs to be overwritten several times before it is physically erased.

You certainly don't owe me an explanation, but clarification would be great.

At any rate, thanks to everybody who replied.

[Skith]

I believe the level of recovery service needed would be labeled "forensic" meaning you would need a professional service. No simple software out there would be able to recover the data. It would take very high technical knowledge and skill, not to mention software, and possibly hardware, to recover such data.

Sorry, but its always best to keep good backups, and run good antivirus software that is up to date. (Unfortunately Norton has gone downhill the last several years.)

[CrayonEater]

It would cost you many thousands of dollars to do such a recovery and odds are good your JPEGs wouldn't exactly be in pristine condition even with a recovery. If it's worth it to you there are private companies available.

[dafoe]

Wow!

All your replies will save me from wasting any more time with other data recovery software. I can do without the hour long drive scans. It sucks. But it's not worth getting all bent out shape over or paying big bucks for professional data recovery. I guess that's just the way it goes.

I just wanted to be sure that there was no posssibility I could get my data back before giving up on it.

Thanks guys.

[jollyjohn]

Do a system restore to a point before infection occured

[BJ_M]

Do a system restore to a point before infection occured

that will not magically repair files which now dont exist

[ROF]

Do a system restore to a point before infection occured

Yes. That'll certainly get rid of all virus or worm infections.

[beglobal]

Here you have a site that might help you out http://www.recoverandbackup.com it has lots of information about data recovery...

You are in breach of the forum rules and are being issued with a formal warning.
/ Moderator BJ_M please do not advertise on this forum without permission ....
please do not dredge up old posts just to advertise - thanks

[normcar]

I use AVG AntiVirus software too. It is rated one of the best, is free, and updated often. It will quickly detect viruses that have been downloaded. Also set up a schedule to scan often, if you open attachments in email without first scanning them.

Yahoo email will scan attachments before you download them to help prevent infection. It has caught a few email viruses for me from emails I thought of as safe.

[fLYtRap]

I've got tired of updating Norton all the time and even when I did I was getting viruses anyway. I have learned since than that the best way is to have 1 computer just for internet without storing any important data on it. I've been doing that since 2003 and all I have is a firewall, IP blocker and pop-up blocker. Every now and than when I see that the windows is going down for some reason I just wipe out the drive writting zeros to drive and re-installing windows. This way I never again have to worry about backing up my data or any updates including windows updates that only messing up my personal settings.
I higly recommend!

[adam]

Overwriting a file in windows does NOT destroy the original file. The new file is stored in random available sectors on the hard drive and the sectors containing the original file are marked as available for future storage by the os. Using the computer from this point on means that new data stored to the hard drive may overwrite these newly freed sectors. But until that happens the data is recoverable via special software. I've done it many times, in some cases recovering data that was overwritten several years prior. I use commercial software, I think its called NTSF recovery or something like that and I remember paying $50 for it. I don't know of any freeware data recovery tools but a quick search on the lovebug virus pulled up some freeware/commercial tools specifically designed to recover jpgs lost due to the virus.

You have definitely lost some of the jpgs but I can guarantee that at least some of them are recoverable. Don't give up hope yet. You don't have to resort to professional services just because something was deleted in windows.

[drwho]

dafoe check you pm