Missing Documents on Windows XP Workstation (disconnected from domain)

[TwiceSliced]

Windows XP laptop on an SBS 2003 domain.

User logged-in to the laptop, using her usual username and password, while disconnected from the network; error message was displayed, but user cannot recall details; user was presented with a fresh desktop (only "All Users" icons were present), opened Word, and saved a document to the desktop.

Upon logging-in the following day, no error message was displayed and the user was presented with their usual desktop and the aforementioned document was gone.

The laptop was supposedly not connected to any networks during or between the two events.

I've checked the "Documents and Settings" folder, run various searches, and combed through the registry for any reference of the missing document, but no luck.

Searching for recently modified files reveals a gap from when the error message was first displayed until the log-in the following day. The last files modified before the gap seem to be related to Windows updates (KBxxxxxx).

Any ideas of where I might look for the missing document?

Thank you.

 

[gimp]

well for one, check the Windows Event viewer at the time the user logged on and got an error message.
The error will be logged.

But it sounds like it couldn't load the user profile, so created a temp profile (in which case the message would have told the user no changes would be saved), and the temp profile folder was automatically deleted when the user logged off.

 

[bigdogchris]

Well is the group policy forwarding My Documents to a network share? If it's disconnected then of course you won't see the files if they are not set as viewable offline.

 

[TwiceSliced]

well for one, check the Windows Event viewer at the time the user logged on and got an error message.
The error will be logged.

But it sounds like it couldn't load the user profile, so created a temp profile (in which case the message would have told the user no changes would be saved), and the temp profile folder was automatically deleted when the user logged off.

That's what I figured... I was just wondering if this was a somewhat common occurrence and if there was a way to recover such data.

Well is the group policy forwarding My Documents to a network share? If it's disconnected then of course you won't see the files if they are not set as viewable offline.

I know, but that's not the case here; she saved the document to the desktop.

 

[YeOldeStonecat]

Well is the group policy forwarding My Documents to a network share? If it's disconnected then of course you won't see the files if they are not set as viewable offline.

I'd say this was part of it....the built in SBS GPO for My Docs redirect was on. Second part of the equation, I'd guess something tanked the users profile, and when they logged in, they were presented with the usual error about the users profile was not able to load, so a default temporary profile was presented of which you cannot save things.

 

[k1pp3r]

Sounds like it loaded up a temp profile for her, saving a document to the desktop of a temp profile generally is not a good thing. Look for a tmp profile in documents and settings and see if its in there.

 

[TwiceSliced]

Again, I'm pretty confident that the auto-redirection of My Documents folders to network resources is not relevant here, as the document was saved to the desktop.

Anyway, it looks like the computer was trying to perform some automatic updates and ran into bad sectors on the hard drive; that would explain not being able to load the user's offline profile and creating some kind of temporary profile.

I've already scoured directories, the registry, and the event logs, but can't find anything... And nobody knows of any way to recover something saved on the desktop of one such temporary profile?

Shit.

Thanks anyway!

 

[gimp]

Again, I'm pretty confident that the auto-redirection of My Documents folders to network resources is not relevant here, as the document was saved to the desktop.

Anyway, it looks like the computer was trying to perform some automatic updates and ran into bad sectors on the hard drive; that would explain not being able to load the user's offline profile and creating some kind of temporary profile.

I've already scoured directories, the registry, and the event logs, but can't find anything... And nobody knows of any way to recover something saved on the desktop of one such temporary profile?

Shit.

Thanks anyway!

well, it'll have been at one point stored on the hdd. So sure, some file recovery software may work, but if the hdd has been in use, had a chkdsk, etc etc, chances are the sectors have been overwritten already.

that would be the only way, though.