No announcement yet.

Please help! Need to recover web history deleted by ASC 6

  • Filter
  • Time
  • Show
Clear All
new posts

  • #16
    Hi Rick A.

    As I don't use I.E. at all... only firefox... i wonder what the exact filename is for the files on my system that were deleted. (I think the last time I even opened IE was over a year and a half ago). What I am saying is that the deleted index.dat files located on my HD (that the Iobit undeleter found) are most likely associated with firefox and not IE as I also ran the ccleaner disk wiper just this last spring. It is only a suggestion that you may yet recover the chrome dat files using the Iobit undeleter... perhaps it is worth a shot?

    I am going to run the undeleter again and look at each file out of curiosity, it only takes about 10 minutes.

    Live long and prosper!


    • #17

      I am a bit concerned, that you chose "Undo Changes" rather than "Restore your Computer to an earlier time". The reason I say this is because " Undochanges is normally used if you have run a restore and are not happy and want to undo the restore. Restore to an earlier time allows you to pick a date before the bad incident occurred.
      In the ASC system restore do you have only one other date available.??

      It is possible also that your windows restore service is/was not enabled. If so then you may only have the one restore point which was created by ASC when your "Technician" ran it.

      Also, Mel suggestion should be worth a try, and running the analyzer is also worth another go. Below is the locations where chrome stores the relevant files on various OS's.

      Let us know what is available in the ASC system restore

      in xp = C:\Documents and Settings\USER\Local Settings\Application Data\Google\Chrome\User Data\Default\

      in vista = C:\users\USER\Local Settings\Application Data\Google\Chrome\User Data\Default\

      win7: C:\Users\[username]\AppData\Local\Google\Chrome\User Data\Default

      The User Data folder contains three files: Local State, Safe Browsing and Safe Browsing Filter, along with a folder called Default. Default in turn contains your browser cache, plugin data, and all of your cookies and history data
      To err is Human. To really mess things up you need a PC.


      • #18
        @Mel, thanks again for trying to help, but I did undelete the files, but to no avail, since with index.dat Analyzer I could only find IE links. As Scannan noted, apparently chrome's index.dat is recorded in a private chrome folder C:\Users\[username]\AppData\Local\Google\Chrome\User Data\Default. Using Recueva I could partially restore it (the index.dat file located in chrome's folder), but it won't read since it was almost destroyed/overwritten from when I inadvertently opened chrome, just to find out my tabs were all gone. ASC undelete doesnt find this index.dat file, only the index.dat that are recorded in Microsofts folders.

        On the brightside..

        @Scannan, you were absolutely right, restoring (instead of 'undoing' changes) the system to a previous state made me recover all my Firefox tabs. The problem is that my FF tabs were personal stuff, that I wanted to read later on but nothing really important, what I really need are my chrome tabs, and those remain erased. Even when restoring the system (I used System Restore because I didn't really understand how to do it with ASC) to previous states, if I open chrome it goes to the google page where I left (searching for ways to recover my history). All the tabs are still gone. I'm so close.. maybe it's possible to recover afterall:) thank you guys so much for the support, I'll keep looking now for some hours for other solutions. Do you suggest any additional steps to be taken?


        • #19
          I am sorry you are still having a problem. Unfortunately as I said previously, the more work you do trying to solve the problem, the more likelihood of overwriting files. Catch 22 situation.
          The only thing I can think of left to try, is to look in the registry.

          Click "Start", click "Run", type regedit in the box. Go. This takes you into the soul of your machine where everything ever done is stored.
          Search the registry one key at a time and take note of the websites. you may recognise the ones you need. (The "keys" are all on the leftand say "Hkey... Each goes to a sector of the OS.) Write the URL down for later use.
          DO NOT DELETE OR CHANGE ANYTHING!. The registry is sensetive. It doesn't mind if you look but gets cranky if you touch. Deleting/changing anything you are not certain of can create serious problems. It is best to make a copy of the registry before you begin, and keep the copy safe. That way if anything goes wrong, you can replace the registry with the copy you made.
          There is no need to be nervous, as long as you just look and note the sites/URL's and do not alter anything.

          Good Luck
          To err is Human. To really mess things up you need a PC.


          • #20
            Hi Scannan! Do you know where to find chrome's url registries? I could only find Internet Explorer's (though I didn't search for Firefox), I tried searching some folders but after realizing there are thousand registry folders I decided to only do this after I had some idea of where to find. Once again, thank you so much for all the help given, I hope I can repay you somehow


            • #21

              Firstly, we are glad to assist you if we can and repayment is absolutely unnecessary.
              Sadly, as I said previously, looking in the registry really is a last resort, and you can see why now. I do not use Google Chrome, and so I cannot do any tests. I am trying to remember from the times when I did have to use Chrome.

              Have a look at this link and try substituting Google for Microsoft and Google Chrome for IE.
              To err is Human. To really mess things up you need a PC.


              • #22
                Scannan, although I'd love to donate some money to you guys, if you'd accept it, I don't have the dough to, I'm a student.. income tends to 0. What I meant, with a bad choice of words, was that I'd be more than glad to help you somehow should you need or want it, but thanks for saying nevertheless that it's not necessary.

                I did make some progress, and I hope you'll forgive me for some ramblings, but I think they'll be quite useful for other users with the same problem. I'm classifying the sollutions into 'Firefox' and 'Chrome', but first a little prelude. You were absolutely right about the Catch22 situation, the more I used my computer to fix it, the worst the problem got. I think that if I had undeleted the temp files in time (right after the accident), they wouldn't be overwritten and impossible to recover now. If they were recovered, I figure all I'd have to do would be to substitute the new files for them, basically copying and pasting (making a backup first of all folders involved!) them to their previous locations. I think that even if I had undeleted or increased System Restore's space for points, it would work well (for Firefox, see below)

                Firefox sollutions:

                1- Using Windows System Restore (ASC 'Rescue' function didn't do the trick, I don't know why). After I loaded a previous point, all I did was open the FF and voila, all my tabs were in place.

                2- I found out ASC keeps a log of its deleted files [go to the 'Rescue' page and click on the dented wheel on the top, the first opened page will be the logs container], so that all it took for me to find all FF deleted urls was opening the log.txt and seeing which sites ("deleted http://www.....) were deleted by ASC actions. The log deleted according to a time order, so that the most recent deletions were also the most recent sites viewed.

                3- Using undelete software. You can get good clues of which sites you visited by checking the deleted temp files with an undelete software search (like Recuva or Pandora, I like Pandora best because you can search inside temp files with an txt viewer, and this gives you even more sites info). There are History Viewer softwares for FF and its history. I'm sorry, but right now I can't remember exactly, I think I found an index.dat for FF, but there are so many ways of finding the links, I don't think it will be necessary. In all my attempts I kept stumbling upon all my FF urls all the time


                Nothing worked.. though I think that if one goes to [Username]\Local Settings\Application Data\Google\Chrome\User Data\Deafult and undelete everything and put it back there replacing all other files, it should work alright. I did find (with Recuva?) an index.dat inside a [Username]\Local Settings\Application Data\Google\Chrome\ folder, just can't remember where. But even if it does have an index.dat, I think Chrome uses sqlite (whatever that is), and anyhow the index.dat is useless (the one I found was partially overwritten and simply won't open). Using System Restore didn't work for me, and finding the url in the registry (you can find FF urls in the registry also, forgot to mention, a History Viewer software will probably have this function) was for me impossible, I have no idea of where it might be. There's no info on the net about this aswell. Chrome doesnt store web info like FF and IE, I was amazed to find out there are no url or other tmp files, just this (that exists in the folder and consequently was deleted by ASC):

                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000248
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000249
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00024a
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00024b
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00024c
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00024d
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00024e
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00024f
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000250
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000251
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000252
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000253
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000254
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000255
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000256
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000257
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\index
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Media Cache\data_0
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Media Cache\data_1
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Media Cache\data_2
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Media Cache\data_3
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Media Cache\index
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Archived History
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Visited Links
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Current Tabs
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Top Sites
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\History Index 2012-11-journal
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\4C01.tmp
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\4C02.tmp
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\D8D3.tmp
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\D8D4.tmp
                Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Current Session

                it all seems pretty generic, not like FF and IE. I've recovered a bunch of partially recovered files and as soon as I can (already lost too much time with this) I'll try runing apps for reading this stuff. But most of it is gone, being replaced with normal PC activity (specially surfing with FF searching for fixes).

                Scannan and Mel, Thank you very much for bearing with me, you were always very sympathetic and I appreciate immensily the help and attention given. I can't do much but I wish you all the best! And at least a good day, or two!
                Kind regards

                EDIT: btw, I think "History Index 2012-11-journal", "History Provider Cache", "Current Tabs" and "Recent Visits" are all very good places to start searching, but I could'nt find those, I only found a partially overwritten Index 2012-10-journal that I'll investigate as soon as possible
                Last edited by RickA; Nov. 27th, 2012, 22:02.


                • #23

                  Thank you very much for your great feedback. I am sure it will be very helpful to other users. We appreciate it.

                  We are very happy to help if we can, and your thanks is greatly appreciated.
                  Please feel free to ask for help at any time.

                  Forthe future you may want to have a look at This Backup Utility for Chrome. It may save you some grief again

                  Best Regards
                  To err is Human. To really mess things up you need a PC.


                  • #24

                    Please look at this thread. In post #7, I attached a printscreen which shows how to open the Registry Change Logs and the Auto Care Logs in the ASC Rescue Centre.
                    You may be able to find your lost URL's there. It is a long shot but worth a look.
                    I have also sent you a PM (private Message) on this.

                    Hope it helps.
                    To err is Human. To really mess things up you need a PC.


                    • #25
                      Hi Scannan, thanks for the interest but this sollution is already in my previous post, and unfortunally for chrome it doesn't work (I posted the deleted chrome files, it's stored under 'History Inder journal' file or something, it's not like FF or IE that stores under normal url types, so one can't guess which sites were deleted). One funny thing I did find was that looking inside the 'journal' file from this month (ie, 2012-11), although it was deleted by ASC, some of the supposed deleted links were still there (if I open it with a txt reader, like MS Notepad). But it is a huge mess, they are scattered without any order or reason. Right now I have absolutely no time to check for new sollutions, but using undelete software I have already stored everything that wasn't overwritten, I'll be looking foward for some heavy data mining days ahead.

                      I tried searching for Winfix sollutions too but nothing seems to apply to my case.

                      Thank you for suggesting the chrome backup program, but from now on I don't think I'll use chrome intead of FF and if it wasn't deleted so well I wouldn't be bothering with all this, so next time I simply won't call that "technician" anymore.

                      Best regards, if I find anything new on this I'll be posting it here

                      PS: for conspiracy theorists;) I searched inside many of google's files for links and what I found mostly awkward was that there were some file's adresses stored in them, I mean, files's adresses from other HDDs plugged into my PC that apparently had no connection to chrome lurking inside files from it's folder. Probably it's not Big Brother, it's just some glitch (I think that partially overwritten files could be doing this) or there is some mysterious connection I didn't get (like [torrent] files downloaded by chrome), but I find it awkward nevertheless


                      • #26
                        Hi RickA.

                        Thanks for the update.

                        Please stay in touch here.

                        Live long and prosper!