Recovering previous versions of deleted files

A forum on data recovery using the professional data recovery software R-STUDIO.
mbeda
Posts: 3
Joined: Fri Sep 08, 2017 2:13 pm

Recovering previous versions of deleted files

Post by mbeda » Fri Sep 08, 2017 4:06 pm

Hello,
Many files at a separated partition have been encrypted by a ransomware. When I try to recover the previous versions of these files using R-Studio, it executes one at a time, and I don't know why the result exibits files that are unrelated to the original.
Does anybody knows the correct procedure for recovering previous versions of deleted files and, if possible, in batches?

Thanks for any help

Data-Medics
Posts: 148
Joined: Tue Oct 20, 2015 10:13 am
Location: Providence, RI USA
Contact:

Re: Recovering previous versions of deleted files

Post by Data-Medics » Sun Sep 10, 2017 11:10 am

Most of the files are likely to be overwritten unless there are shadow copies that weren't nuked by the virus. And even if there were back versions it's usually limited to the last few Gb of deleted/encrypted files. Very few people set their versioning to 50% hard drive space. Default I think is 5%, so that's the max disk space used for versioning.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Recovering previous versions of deleted files

Post by Alt » Mon Sep 11, 2017 5:45 am

New ransomware deletes unencrypted versions of encrypted files properly - they actually wipe them out.

mbeda
Posts: 3
Joined: Fri Sep 08, 2017 2:13 pm

Re: Recovering previous versions of deleted files

Post by mbeda » Wed Sep 13, 2017 1:40 pm

Thanks for help. These files hadn't a shadow copy. Despite this I'm having success on recovering some deleted files (orginal files not encrypted) with the R-Studio's previous version lookup resource, but only one at a time. Is it possible to restore previous versions of files through a folder or group of files?

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Recovering previous versions of deleted files

Post by Alt » Thu Sep 14, 2017 1:24 pm

mbeda wrote:Thanks for help. These files hadn't a shadow copy. Despite this I'm having success on recovering some deleted files (orginal files not encrypted) with the R-Studio's previous version lookup resource, but only one at a time. Is it possible to restore previous versions of files through a folder or group of files?
The problem is that it's hard to find which alleged previous versions of encrypted files are real.

mbeda
Posts: 3
Joined: Fri Sep 08, 2017 2:13 pm

Re: Recovering previous versions of deleted files

Post by mbeda » Wed Sep 20, 2017 10:41 am

Ok Alt.
thanks for help!
Mauricio

Post Reply