Announcement

Collapse
No announcement yet.

Please help! Need to recover web history deleted by ASC 6

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • RickA
    started a topic Please help! Need to recover web history deleted by ASC 6

    Please help! Need to recover web history deleted by ASC 6

    Good evening, my computer was having blue screens of death and so I called a technician that ran ASC 6.0 free edition on my computer using the default settings. The problem is it deleted all my chrome history leaving me without almost 50 tabs that I was reading for a research that I have to deliver on monday. There's no possible way I can search all those sites again and I'm desperately looking for a way to recover the links from the deleted history. Is it possible at all? Does anyone know if the program deletes the index.dat file? Can I maybe use a index.dat file reader to recover those sites (that's the only sollution I could find in google)? Thank you very much for your attention and for any suggestions, all answers will be highly appreciated!

    edit: I'm sorry, here are my specs:
    OS: WIndows 7 Ultimate 64 bit
    AV: Avast free edition
    IObit: Advanced System Care 6.0 free edition

    PC: Intel i7, 4Gb RAM

  • Melvin_Deal
    replied
    Hi RickA.

    Thanks for the update.

    Please stay in touch here.

    Sincerely,
    -Mel
    Live long and prosper!

    Leave a comment:


  • RickA
    replied
    Hi Scannan, thanks for the interest but this sollution is already in my previous post, and unfortunally for chrome it doesn't work (I posted the deleted chrome files, it's stored under 'History Inder journal' file or something, it's not like FF or IE that stores under normal url types, so one can't guess which sites were deleted). One funny thing I did find was that looking inside the 'journal' file from this month (ie, 2012-11), although it was deleted by ASC, some of the supposed deleted links were still there (if I open it with a txt reader, like MS Notepad). But it is a huge mess, they are scattered without any order or reason. Right now I have absolutely no time to check for new sollutions, but using undelete software I have already stored everything that wasn't overwritten, I'll be looking foward for some heavy data mining days ahead.

    I tried searching for Winfix sollutions too but nothing seems to apply to my case.

    Thank you for suggesting the chrome backup program, but from now on I don't think I'll use chrome intead of FF and if it wasn't deleted so well I wouldn't be bothering with all this, so next time I simply won't call that "technician" anymore.

    Best regards, if I find anything new on this I'll be posting it here


    PS: for conspiracy theorists;) I searched inside many of google's files for links and what I found mostly awkward was that there were some file's adresses stored in them, I mean, files's adresses from other HDDs plugged into my PC that apparently had no connection to chrome lurking inside files from it's folder. Probably it's not Big Brother, it's just some glitch (I think that partially overwritten files could be doing this) or there is some mysterious connection I didn't get (like [torrent] files downloaded by chrome), but I find it awkward nevertheless

    Leave a comment:


  • Scannan
    replied
    RickA

    Please look at this thread. In post #7, I attached a printscreen which shows how to open the Registry Change Logs and the Auto Care Logs in the ASC Rescue Centre.
    You may be able to find your lost URL's there. It is a long shot but worth a look.
    I have also sent you a PM (private Message) on this.

    Hope it helps.

    Leave a comment:


  • Scannan
    replied
    RickA

    Thank you very much for your great feedback. I am sure it will be very helpful to other users. We appreciate it.

    We are very happy to help if we can, and your thanks is greatly appreciated.
    Please feel free to ask for help at any time.

    Forthe future you may want to have a look at This Backup Utility for Chrome. It may save you some grief again

    Best Regards

    Leave a comment:


  • RickA
    replied
    Scannan, although I'd love to donate some money to you guys, if you'd accept it, I don't have the dough to, I'm a student.. income tends to 0. What I meant, with a bad choice of words, was that I'd be more than glad to help you somehow should you need or want it, but thanks for saying nevertheless that it's not necessary.

    I did make some progress, and I hope you'll forgive me for some ramblings, but I think they'll be quite useful for other users with the same problem. I'm classifying the sollutions into 'Firefox' and 'Chrome', but first a little prelude. You were absolutely right about the Catch22 situation, the more I used my computer to fix it, the worst the problem got. I think that if I had undeleted the temp files in time (right after the accident), they wouldn't be overwritten and impossible to recover now. If they were recovered, I figure all I'd have to do would be to substitute the new files for them, basically copying and pasting (making a backup first of all folders involved!) them to their previous locations. I think that even if I had undeleted or increased System Restore's space for points, it would work well (for Firefox, see below)

    Firefox sollutions:

    1- Using Windows System Restore (ASC 'Rescue' function didn't do the trick, I don't know why). After I loaded a previous point, all I did was open the FF and voila, all my tabs were in place.

    2- I found out ASC keeps a log of its deleted files [go to the 'Rescue' page and click on the dented wheel on the top, the first opened page will be the logs container], so that all it took for me to find all FF deleted urls was opening the log.txt and seeing which sites ("deleted http://www.....) were deleted by ASC actions. The log deleted according to a time order, so that the most recent deletions were also the most recent sites viewed.

    3- Using undelete software. You can get good clues of which sites you visited by checking the deleted temp files with an undelete software search (like Recuva or Pandora, I like Pandora best because you can search inside temp files with an txt viewer, and this gives you even more sites info). There are History Viewer softwares for FF and its history. I'm sorry, but right now I can't remember exactly, I think I found an index.dat for FF, but there are so many ways of finding the links, I don't think it will be necessary. In all my attempts I kept stumbling upon all my FF urls all the time


    Chrome:

    Nothing worked.. though I think that if one goes to [Username]\Local Settings\Application Data\Google\Chrome\User Data\Deafult and undelete everything and put it back there replacing all other files, it should work alright. I did find (with Recuva?) an index.dat inside a [Username]\Local Settings\Application Data\Google\Chrome\ folder, just can't remember where. But even if it does have an index.dat, I think Chrome uses sqlite (whatever that is), and anyhow the index.dat is useless (the one I found was partially overwritten and simply won't open). Using System Restore didn't work for me, and finding the url in the registry (you can find FF urls in the registry also, forgot to mention, a History Viewer software will probably have this function) was for me impossible, I have no idea of where it might be. There's no info on the net about this aswell. Chrome doesnt store web info like FF and IE, I was amazed to find out there are no url or other tmp files, just this (that exists in the folder and consequently was deleted by ASC):

    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000248
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000249
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00024a
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00024b
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00024c
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00024d
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00024e
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00024f
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000250
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000251
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000252
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000253
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000254
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000255
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000256
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000257
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Cache\index
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Media Cache\data_0
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Media Cache\data_1
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Media Cache\data_2
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Media Cache\data_3
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Media Cache\index
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Archived History
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Visited Links
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Current Tabs
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Top Sites
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\History Index 2012-11-journal
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\4C01.tmp
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\4C02.tmp
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\D8D3.tmp
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\D8D4.tmp
    Deleted C:\Users\[**user name**]\AppData\Local\Google\Chrome\User Data\Default\Current Session

    it all seems pretty generic, not like FF and IE. I've recovered a bunch of partially recovered files and as soon as I can (already lost too much time with this) I'll try runing apps for reading this stuff. But most of it is gone, being replaced with normal PC activity (specially surfing with FF searching for fixes).

    Scannan and Mel, Thank you very much for bearing with me, you were always very sympathetic and I appreciate immensily the help and attention given. I can't do much but I wish you all the best! And at least a good day, or two!
    Kind regards



    EDIT: btw, I think "History Index 2012-11-journal", "History Provider Cache", "Current Tabs" and "Recent Visits" are all very good places to start searching, but I could'nt find those, I only found a partially overwritten Index 2012-10-journal that I'll investigate as soon as possible
    Last edited by RickA; Nov. 27th, 2012, 22:02.

    Leave a comment:


  • Scannan
    replied
    RickA

    Firstly, we are glad to assist you if we can and repayment is absolutely unnecessary.
    Sadly, as I said previously, looking in the registry really is a last resort, and you can see why now. I do not use Google Chrome, and so I cannot do any tests. I am trying to remember from the times when I did have to use Chrome.

    Have a look at this link and try substituting Google for Microsoft and Google Chrome for IE.

    Leave a comment:


  • RickA
    replied
    Hi Scannan! Do you know where to find chrome's url registries? I could only find Internet Explorer's (though I didn't search for Firefox), I tried searching some folders but after realizing there are thousand registry folders I decided to only do this after I had some idea of where to find. Once again, thank you so much for all the help given, I hope I can repay you somehow

    Leave a comment:


  • Scannan
    replied
    I am sorry you are still having a problem. Unfortunately as I said previously, the more work you do trying to solve the problem, the more likelihood of overwriting files. Catch 22 situation.
    The only thing I can think of left to try, is to look in the registry.

    Click "Start", click "Run", type regedit in the box. Go. This takes you into the soul of your machine where everything ever done is stored.
    Search the registry one key at a time and take note of the websites. you may recognise the ones you need. (The "keys" are all on the leftand say "Hkey... Each goes to a sector of the OS.) Write the URL down for later use.
    DO NOT DELETE OR CHANGE ANYTHING!. The registry is sensetive. It doesn't mind if you look but gets cranky if you touch. Deleting/changing anything you are not certain of can create serious problems. It is best to make a copy of the registry before you begin, and keep the copy safe. That way if anything goes wrong, you can replace the registry with the copy you made.
    There is no need to be nervous, as long as you just look and note the sites/URL's and do not alter anything.

    Good Luck

    Leave a comment:


  • RickA
    replied
    @Mel, thanks again for trying to help, but I did undelete the files, but to no avail, since with index.dat Analyzer I could only find IE links. As Scannan noted, apparently chrome's index.dat is recorded in a private chrome folder C:\Users\[username]\AppData\Local\Google\Chrome\User Data\Default. Using Recueva I could partially restore it (the index.dat file located in chrome's folder), but it won't read since it was almost destroyed/overwritten from when I inadvertently opened chrome, just to find out my tabs were all gone. ASC undelete doesnt find this index.dat file, only the index.dat that are recorded in Microsofts folders.

    On the brightside..

    @Scannan, you were absolutely right, restoring (instead of 'undoing' changes) the system to a previous state made me recover all my Firefox tabs. The problem is that my FF tabs were personal stuff, that I wanted to read later on but nothing really important, what I really need are my chrome tabs, and those remain erased. Even when restoring the system (I used System Restore because I didn't really understand how to do it with ASC) to previous states, if I open chrome it goes to the google page where I left (searching for ways to recover my history). All the tabs are still gone. I'm so close.. maybe it's possible to recover afterall:) thank you guys so much for the support, I'll keep looking now for some hours for other solutions. Do you suggest any additional steps to be taken?

    Leave a comment:


  • Scannan
    replied
    RickA

    I am a bit concerned, that you chose "Undo Changes" rather than "Restore your Computer to an earlier time". The reason I say this is because " Undochanges is normally used if you have run a restore and are not happy and want to undo the restore. Restore to an earlier time allows you to pick a date before the bad incident occurred.
    In the ASC system restore do you have only one other date available.??

    It is possible also that your windows restore service is/was not enabled. If so then you may only have the one restore point which was created by ASC when your "Technician" ran it.

    Also, Mel suggestion should be worth a try, and running the analyzer is also worth another go. Below is the locations where chrome stores the relevant files on various OS's.

    Let us know what is available in the ASC system restore

    in xp = C:\Documents and Settings\USER\Local Settings\Application Data\Google\Chrome\User Data\Default\

    in vista = C:\users\USER\Local Settings\Application Data\Google\Chrome\User Data\Default\

    win7: C:\Users\[username]\AppData\Local\Google\Chrome\User Data\Default

    The User Data folder contains three files: Local State, Safe Browsing and Safe Browsing Filter, along with a folder called Default. Default in turn contains your browser cache, plugin data, and all of your cookies and history data

    Leave a comment:


  • Melvin_Deal
    replied
    Hi Rick A.

    As I don't use I.E. at all... only firefox... i wonder what the exact filename is for the files on my system that were deleted. (I think the last time I even opened IE was over a year and a half ago). What I am saying is that the deleted index.dat files located on my HD (that the Iobit undeleter found) are most likely associated with firefox and not IE as I also ran the ccleaner disk wiper just this last spring. It is only a suggestion that you may yet recover the chrome dat files using the Iobit undeleter... perhaps it is worth a shot?

    I am going to run the undeleter again and look at each file out of curiosity, it only takes about 10 minutes.

    Sincerely,
    -Mel
    Live long and prosper!

    Leave a comment:


  • RickA
    replied
    Thank you Mel, the problem is that the only index.dat that are found, even after system restore, are the ones from microsoft's internet explorer, but I never use IE, only sometimes for emails. Usually I use Firefox or chrome, for my research I was using chrome because it loads faster. But now I can't find chrome's index.dat, even with the system restore trick. I can hardly believe I'll have to redo all my research, everything was basically ready, I was only lacking the time to put the information together in the text. All the days I spent searching for relevant information are gone, there's no way I'll be able to redo everything. But life is like that, it can't be simple, it's always against you. Thank you for your help, it was very kind of both of you to try to help me, thank you very much for your support! At least in some people we can always trust.

    Leave a comment:


  • Melvin_Deal
    replied
    Hi RickA.

    Im not sure that I understand... are you saying you ran system restore and there was no gain and you seek other suggestions?

    I tried running Iobit Undelete from the toolbox and then using the search box on it (after it completed its scan) typing in "index.dat" and it narrowed everything to only 7 files (out of over 37,000)!! (as per my suggestion in post #8) Perhaps that method will work after all??:grin:




    I also followed the above procedure but entered only .dat in the search box. About twenty items came out of that search, including the same 7 index.dat files... accompanied by about 12 dat files associated with various non browser softwares.

    Don't be confused by the "modified on" column... It will show the date and the time that the Iobit undeleter located them as they had already been deleted (I think).


    Sincerely,
    -Mel
    Live long and prosper!
    Attached Files
    Last edited by Melvin_Deal; Nov. 24th, 2012, 00:41.

    Leave a comment:


  • RickA
    replied
    Scannan, thank you very much for your patience, all my previous attempts failed so I'm more than ready to try the Rescue function. I created a Restore Point and clicked on 'undo changes' for a period that, if I'm not mistaken, ASC created right before doing any changes on the pc (in Windows's System Restore there's only one previous point dating back to yesterday (the day my techinician blew things up), not a single other restore point available). It says it's 'done', all registry value were changed, but what do I do now?:/ Should I try again the index.dat Analyzer? I tried to, but do you know what should I do? Once more, thank you very much for the help, you have no idea of how much you are helping me!

    Leave a comment:

Working...
X