system restore points and deleted local user profiles

[Henk]

Because of (very) low hd space I have inadvertently deleted a number of
"unknown accounts" from a windows XP pro machine. Profiles were deleted
through "my computer, properties, advanced, user profiles, settings".

Now it appears MS outlook 2003 had stored the pst file of an active user
account in the application data section of one of the unknown accounts. I
remember reading somewhere that system restore points also includes local
user profiles. Can anyone please tell me if this will also recover deleted
user profiles, including any files stored in the profile?

I have first tried an undelete program (pcinspector from convar) but it does
not find the deleted data. (the computer has been used for a few hours after
deleting the profiles, so probably these data were overwritten.

Thanks,

 

[Bennett Marco]

Because of (very) low hd space I have inadvertently deleted a number of
"unknown accounts" from a windows XP pro machine. Profiles were deleted
through "my computer, properties, advanced, user profiles, settings".

Now it appears MS outlook 2003 had stored the pst file of an active user
account in the application data section of one of the unknown accounts. I
remember reading somewhere that system restore points also includes local
user profiles. Can anyone please tell me if this will also recover deleted
user profiles, including any files stored in the profile?

While it might restore the profile, it probably will not restore the
files.

Try it and find out. It's reversible.

 

[Henk]

Thanks for your fast response.

Problem is I expect your are right. Just want to be very sure before I try,
since system restore will definitely do some more writing to the hdd, further
reducing the chances of recovery (by professional data recovery).

Henk

 

[Bennett Marco]

Thanks for your fast response.

Problem is I expect your are right. Just want to be very sure before I try,
since system restore will definitely do some more writing to the hdd, further
reducing the chances of recovery (by professional data recovery).

Henk

Maybe it's time that you look into a good backup strategy, hmm?

Acronis True Image and a USB hard drive would be a good move.

 

[Henk]

Yep, backup would have been smarter. Personally I prefer Windows Home Server
for backup since it's fully automated and incremental (cluster based). If
you're not familiar with it please have a look at it. It's awesome!

In this case it's not my laptop (I didn't personally delete the user
profiles) and I have also adviced the owner to adopt some kind of backup
strategy, including your suggestions.

Right now however it's damage control and trying to recover as much as
possible. I think professional data recovery is the only valid option right
now.

As to my original question, after some more research I think I found the
answer overhere:

http://msdn.microsoft.com/en-us/library/ms997627.aspx#windowsxpsystemrestore_whats

System restore does restore (local, not roaming) user profiles, however
user-created data stored in the user profile is not recovered by system
restore. I expect outlook data files are considered user-created data and
will therefore not be restored.

Thank you very much for your support and help. It's always nice to get quick
response to a question!

 

[Jose]

Because of (very) low hd space I have inadvertently deleted a number of
"unknown accounts" from a windows XP pro machine. Profiles were deleted
through "my computer, properties, advanced, user profiles, settings".

Now it appears MS outlook 2003 had stored the pst file of an active user
account in the application data section of one of the unknown accounts. I
remember reading somewhere that system restore points also includes local
user profiles. Can anyone please tell me if this will also recover deleted
user profiles, including any files stored in the profile?

I have first tried an undelete program (pcinspector from convar) but it does
not find the deleted data. (the computer has been used for a few hours after
deleting the profiles, so probably these data were overwritten.

Thanks,

Has your investigation lead you to the conclusion that Outlook stores
active user account information in the application data section of
another user account?

That would be most interesting.

 

[Henk Panneman]

Yes,

I guess this happened when copying user profiles to a new profile when
client systems were moved to another domain. This was done roughly two years
ago, and from what I know done according to procedures as advised by MS. Move
was done by ms certified pro. At the time the old profiles (apparently) were
not deleted.

I have checked another system from the same period and there it's the same.
Interestingly the outlook data files (and the encompassing folders) are all
that is left in the old profile. No other folders left (view hidden and
system files enabled).

 

[Jose]

Yes,

I guess this happened when copying user profiles to a new profile when
client systems were moved to another domain. This was done roughly two years
ago, and from what I know done according to procedures as advised by MS. Move
was done by ms certified pro. At the time the old profiles (apparently) were
not deleted.

I have checked another system from the same period and there it's the same.
Interestingly the outlook data files (and the encompassing folders) are all
that is left in the old profile. No other folders left (view hidden and
system files enabled).

I must have missed the part in your previous posts where you said you
were trying to copy profiles around.

The outlook.pst file is "part" of the user profile, so it sounds like
this was a self inflicted wound. You may have the "illusion" of mixed
up user data, but it all makes sense to me.

There is usually one outlook.pst file per profile and it would be
pretty easy to just copy one over the top of the other, but I do not
think Outlook is going to "share" two outlook.pst files. If it did,
people would be screaming all over the place.

There are good instructions from MS about how to copy profiles to
handle profile corruption, name changes, etc.

Like you read, SR will restore a deleted profile, but SR will not
restore the outlook.pst (user created data) files of the deleted
profile. It is not supposed to.

Oh well, hope you get it figured out.

 

[Henk Panneman]

AFAIK profiles WERE moved according to MS instructions; system properties,
advanced, user profiles, copy exisitng profile to a new profile. New profile
was then associated with AD login. Apparently outlook data files are not
copied this way. Also the remaining "profile" (like I said, contains only
outlook data files) is not associated with a valid local or AD login.

It's very well possible a mistake was made when copying the profiles,
however like I mentioned before it was done per MS instructions available at
that time by MS certified SBS expert.

If I have some time I will try and find out if keeping outlook data files
stored in old profile path when copying user profile is by design or if it's
caused by some error or omission in the procedure that was used.

 

[Henk Panneman]

Found the root of the problem;

When you copy a profile using the User Profiles tab, Windows does NOT copy
the hidden Local Settings folder in the profile. The folder stores
non-essential files, but it's also the default storage location for Outlook
mail stores (PST files). If you need these files as part of the destination
profile, you need to copy the Local Settings folder (or just the files you
need) manually to the target profile.

 

[Jose]

Found the root of the problem;

When you copy a profile using the User Profiles tab, Windows does NOT copy
the hidden Local Settings folder in the profile. The folder stores
non-essential files, but it's also the default storage location for Outlook
mail stores (PST files). If you need these files as part of the destination
profile, you need to copy the Local Settings folder (or just the files you
need) manually to the target profile.

Sounds like it is working as advertised.

The MS article says that the target profile will be a "near duplicate"
of the source and "another method" (in a different article) should be
used (especially) for Outlook related items (Mail folders, address
book, and e-mail messages).

If you miss that step and then actually delete the source profile and
all it's data, you could have a problem.

Oh well... glad it is sorted out!