Recovery Of An Overwritten Microsoft Word File.

[siamect]

Firstly, the executable file. Downloading EXE files from other than proven, trusted sources is one of the easiest ways to get your computer hacked - just because it appears to do what you want it to do doesn't mean that is all it is doing - and don't think your antivirus will save you! These things are a hacker's dream come true.

Also, as the scheduled task is run under the system account, you will not see any errors logged on screen either.

First point is very correct and cannot be repeated enough.

But I wonder if a scheduled task regardless if it is a VB script or other is running under the system account. This would in my eyes be a clear bug. Any script that is running should be running under a specific user and should be limited to the privileges that that user has. Otherwise I can schedule a script that elevates my privileges to whatever level I like....

Right or ? I mean you never know what MS is doing... but there must be some limits somewhere.

Martin

[lopburi3]

Just a brief comment that I have not fund backup in Windows 7 to be much of a problem as it can be done in the background so if it takes several hours it is not an issue for me. Perhaps on a laptop that is mostly turned off it would be? It is a lifesaver in a situation like this however. If you have it; use it.

[frinch11]

Firstly, the executable file. Downloading EXE files from other than proven, trusted sources is one of the easiest ways to get your computer hacked - just because it appears to do what you want it to do doesn't mean that is all it is doing - and don't think your antivirus will save you! These things are a hacker's dream come true.

Also, as the scheduled task is run under the system account, you will not see any errors logged on screen either.

First point is very correct and cannot be repeated enough.

But I wonder if a scheduled task regardless if it is a VB script or other is running under the system account. This would in my eyes be a clear bug. Any script that is running should be running under a specific user and should be limited to the privileges that that user has. Otherwise I can schedule a script that elevates my privileges to whatever level I like....

Right or ? I mean you never know what MS is doing... but there must be some limits somewhere.

Martin

I understand what you are saying but there is no inconsistency because in order to schedule a task (and assign a task to the system account) you need to have enhanced privileges.

Not sure what you mean by " I mean you never know what MS is doing" FWIW I have always known what they were doing - in the context of what I was doing , or trying to do, of course. If MS has a fault, it is trying to be all things to all people, but don't forget that before there was an Internet revolution there was a PC revolution, and MS drove the both. Without them we wouldn't be talking now (assuming I haven't sent you to sleep!)

[siamect]

I understand what you are saying but there is no inconsistency because in order to schedule a task (and assign a task to the system account) you need to have enhanced privileges.

Not sure what you mean by " I mean you never know what MS is doing" FWIW I have always known what they were doing - in the context of what I was doing , or trying to do, of course. If MS has a fault, it is trying to be all things to all people, but don't forget that before there was an Internet revolution there was a PC revolution, and MS drove the both. Without them we wouldn't be talking now (assuming I haven't sent you to sleep!)

Since when has it been a good idea to use a system account to backup your data? Ok I know you maybe needing it to create a system restore point but that has already been declared as a bad way of backing up your data. So with that out of the way... You should never use higher privileges than you need... You don't need any higher privileges to schedule a task.

If you say you know what MS is doing you must be the first one I have meet who claims that...congratulations! If you don't claim that, you should have no problem understand my statement that you quoted...

And before there were the PC revolution there was a story about how MS got it's DOS into IBM PC... less impressive...

There were better alternatives at that time...

Martin

[Cloggie]

Noticed this program this morning - ignore the Dutch - just go to "Downloads"

http://www.zdnet.nl/...ee-edition-6-0/

Edited November 12, 2010 by Cloggie

[Digitalbanana]

I have used this part of Windows 7 (Windows Back Up) which has options to do incremental backs on regular schedules. I found it (though a good idea) to be slow and ponderous. Incremental back ups took hours when only a few data files had been changed. I switched to a third party product (Acronis, but there are others to choose) and back up has become a pleasure rather than a chore taking a few minutes or seconds. It can be scheduled or even run in continuous back up mode. Just need to remember to have an external drive space plugged/networked in.

Yes and be careful... acronis is using a proprietary format to store your data. The only program that can restore it is... acronis.... so don't use this for data that you may need to restore far in the future... there are better alternatives...

I don't know the format MS is using for their backup program... I have the feeling that it may require you to use the same version to restore... As far as I remember that was the case in win95/98 but I'm not sure.

Martin

Yes, very valid point. I would only use propriety format backups for immediate and short term encoded back ups, useful for laptops and insurance against sudden hard disc failure, over written files, where time is of the essence.

[Mobi]

Sorry if this reads like a dull, humourless lecture!

Thank you frinch11, for all your helpful comments, not at all dull, but I must admit to not smiling very much....

Regarding the 'automated restore points', I have already checked the event viewer and the only restore points that have been created were when I backed up the whole system to an external disk - approx every 2 weeks. I am downloading new software all the time, certainly every day or so, which according to you, should have prompted the system to create a restore point. Well I'm sorry to say it hasn't, not at any time since I have had W7, well over a year now.

Also the pop up help window when I select "restore previous versions" on a Microsoft word file says, in part,:

"Previous versions are automatically saved as part of a restore point. If system protection is turned on, Windows automatically creates previous versions of files and folders that have been modified since the last restore point was made. Typically, restore points are made once a day. If your disk is partitioned or if you have more than one hard disk on your computer, you need to turn on system protection for the other partitions or disks. Previous versions are also created by Windows Backup when you back up your files."

The system protection was turned on and the file was on the default disk C.

There seems little doubt that earlier versions of files can be restored by using this method. Indeed I have tried on other files that have been overwritten since the last restore point/system back up, 2 weeks ago, and I can restore the previous version of the file.

So there is no doubt in my mind that if the automated restore points function had been working 'as advertised' I wouldn't be having this nightmare. Do you agree?

With regard to Microsoft Word, I have extensively researched all the various methods Microsoft advise for recovering lost files, and none of them work in my case. I also noted that none of the suggested recovery methods itemised by M/S mention the recovery of an OVERWRITTEN file, only 'deleted' files and files lost through system crashes, faulty hard disks etc.

By using some recovery software I believe I have located the overwritten file, (several versions as it was being continually updated prior to it being overwritten, and yes the size of the file was about right.)I have succeeded in opening the overwritten file in "Word Pad" and also in "Open Office", when it wouldn't open in M/S Word. The resultant text was gibberish. I have then succeeded in opening the file in M/S word by using the 'recover text from any file' option when selecting the Wordpad file to open. The result, as previously posted,is that the gibberish changes from 'Asian,' character based gibberish, to 'Roman' based gibberish.

Is there anyway to decode the gibberish or do I need an expert?

[Mobi]

Noticed this program this morning - ignore the Dutch - just go to "Downloads"

http://www.zdnet.nl/...ee-edition-6-0/

You might well say "ignore the Dutch" but it's a good job I figured out what "Klik hier om de download te starten." means

Unfortunately this software is incompatible with a 64 bit system so I couldn't run it.

[Cloggie]

Double post..

Edited November 12, 2010 by Cloggie

[frinch11]

Sorry if this reads like a dull, humourless lecture!

Thank you frinch11, for all your helpful comments, not at all dull, but I must admit to not smiling very much....

Regarding the 'automated restore points', I have already checked the event viewer and the only restore points that have been created were when I backed up the whole system to an external disk - approx every 2 weeks. I am downloading new software all the time, certainly every day or so, which according to you, should have prompted the system to create a restore point. Well I'm sorry to say it hasn't, not at any time since I have had W7, well over a year now.

Also the pop up help window when I select "restore previous versions" on a Microsoft word file says, in part,:

"Previous versions are automatically saved as part of a restore point. If system protection is turned on, Windows automatically creates previous versions of files and folders that have been modified since the last restore point was made. Typically, restore points are made once a day. If your disk is partitioned or if you have more than one hard disk on your computer, you need to turn on system protection for the other partitions or disks. Previous versions are also created by Windows Backup when you back up your files."

The system protection was turned on and the file was on the default disk C.

There seems little doubt that earlier versions of files can be restored by using this method. Indeed I have tried on other files that have been overwritten since the last restore point/system back up, 2 weeks ago, and I can restore the previous version of the file.

So there is no doubt in my mind that if the automated restore points function had been working 'as advertised' I wouldn't be having this nightmare. Do you agree?

With regard to Microsoft Word, I have extensively researched all the various methods Microsoft advise for recovering lost files, and none of them work in my case. I also noted that none of the suggested recovery methods itemised by M/S mention the recovery of an OVERWRITTEN file, only 'deleted' files and files lost through system crashes, faulty hard disks etc.

By using some recovery software I believe I have located the overwritten file, (several versions as it was being continually updated prior to it being overwritten, and yes the size of the file was about right.)I have succeeded in opening the overwritten file in "Word Pad" and also in "Open Office", when it wouldn't open in M/S Word. The resultant text was gibberish. I have then succeeded in opening the file in M/S word by using the 'recover text from any file' option when selecting the Wordpad file to open. The result, as previously posted,is that the gibberish changes from 'Asian,' character based gibberish, to 'Roman' based gibberish.

Is there anyway to decode the gibberish or do I need an expert?

You could try opening it in a hex editor and trying to view it in different formats. You could Google "recovering a corrupted word file" and try some of the software that claims to do this (with the caveat I mentioned earlier). Make a copy of your recovered files though - never work on the originals. You could also try to locate some file utilities and try to convert the file, rename it to .doc or .txt and see what happens - just try anything you can think of or a google search recommends - you have nothing to lose. But as I said only work on copies of the file, keep the original

[frinch11]

Fwiw I just tried to view a .docx document in a hex viewer and it was gibberish - but then I used an online converter to convert it to .doc format and all the text was visible in the hex editor. So definitely try converting it (a copy of it!) to .doc and see what you get

[Mobi]

Fwiw I just tried to view a .docx document in a hex viewer and it was gibberish - but then I used an online converter to convert it to .doc format and all the text was visible in the hex editor. So definitely try converting it (a copy of it!) to .doc and see what you get

O.k. I downloaded a hex editor and opened the gibberish file into the editor. On the left side I have these neat numbers and letters and on the right side is the gibberish.

I found an on-line converter (Textopus) but I can't seem to make it work properly.

I opened an un-garbled word file and input it into my hex editor. Then I copied the hex string and input the hex numbers into the on-line converter, but the output is gibberish. (from a good word file). I must be doing something wrong.

Could you let me know what on-line hex-text converter you are using? Maybe it works better than the one I am using.

Thanks

Edited November 12, 2010 by Mobi

[siamect]

Fwiw I just tried to view a .docx document in a hex viewer and it was gibberish - but then I used an online converter to convert it to .doc format and all the text was visible in the hex editor. So definitely try converting it (a copy of it!) to .doc and see what you get

open it in Winzip or 7zip is better.... docx is a zipped format containing xml files that are readable in any text editor...

Edited November 12, 2010 by siamect

[frinch11]

Fwiw I just tried to view a .docx document in a hex viewer and it was gibberish - but then I used an online converter to convert it to .doc format and all the text was visible in the hex editor. So definitely try converting it (a copy of it!) to .doc and see what you get

O.k. I downloaded a hex editor and opened the gibberish file into the editor. On the left side I have these neat numbers and letters and on the right side is the gibberish.

I found an on-line converter (Textopus) but I can't seem to make it work properly.

I opened an un-garbled word file and input it into my hex editor. Then I copied the hex string and input the hex numbers into the on-line converter, but the output is gibberish. (from a good word file). I must be doing something wrong.

Could you let me know what on-line hex-text converter you are using? Maybe it works better than the one I am using.

Thanks

I converted the docx to doc here:

http://doc.investintech.com/

then opened the doc file in the hex editor downloaded from here:

http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm

[steve187]

.docx is a word 2007 document .doc are all other versions, copy the .docx document and then just delete the x off the end of the copy

[Mobi]

7Zip and Win zip don't work.

I was using the same hex editor as you and the on-line conversion failed.

I have sent a query to the guy in Phuket but am not holding out much hope.

I think its time to accept that the file is lost and move on.

It hasn't been a complete waste of time as I have learned about W7 restore points and have now set up a daily schedule. The crazy thing is that the system is now creating a restore point every time I download new software and Windows updates. So whatever I did when I set up my daily 'restore point schedule', it seems to have triggered the system to behave as it should have done all along.

I now have restore points coming out of my ears

Anyway, many thanks for all the advice, it is much appreciated.

[frinch11]

7Zip and Win zip don't work.

I was using the same hex editor as you and the on-line conversion failed.

I have sent a query to the guy in Phuket but am not holding out much hope.

I think its time to accept that the file is lost and move on.

It hasn't been a complete waste of time as I have learned about W7 restore points and have now set up a daily schedule. The crazy thing is that the system is now creating a restore point every time I download new software and Windows updates. So whatever I did when I set up my daily 'restore point schedule', it seems to have triggered the system to behave as it should have done all along.

I now have restore points coming out of my ears

Anyway, many thanks for all the advice, it is much appreciated.

Send me your file

[siamect]

7Zip and Win zip don't work.

I was using the same hex editor as you and the on-line conversion failed.

I have sent a query to the guy in Phuket but am not holding out much hope.

I think its time to accept that the file is lost and move on.

It hasn't been a complete waste of time as I have learned about W7 restore points and have now set up a daily schedule. The crazy thing is that the system is now creating a restore point every time I download new software and Windows updates. So whatever I did when I set up my daily 'restore point schedule', it seems to have triggered the system to behave as it should have done all along.

I now have restore points coming out of my ears

Anyway, many thanks for all the advice, it is much appreciated.

Send me your file

If the file is corrupt it will not be possible to unzip it.... and that is actually how it should be. The worst thing is if you don't know that you documents are missing content and you go on like that ....

Edited November 12, 2010 by siamect

[siamect]

.docx is a word 2007 document .doc are all other versions, copy the .docx document and then just delete the x off the end of the copy

The doc and the docx are two completely different formats... doc is a proprietary MS format and docx is an ISO standard (MS Open Office XML) that MS got approval of by corrupting the ISO comities in many countries. It is however slightly less proprietary than doc format but you can squeeze in a number of different proprietary format inside docx documents.

The docx format was created in a try to stop the success of the Open Document Format that most other office suits are compatible with and that was approved by ISO earlier.

Open Document Format does not contain anything that allow inclusion of proprietary formatted files.

So now we have to live with incompatibilities again.... sux...

Martin

[lopburi3]

when I backed up the whole system to an external disk - approx every 2 weeks

Now I am completely lost - why don't you just restore the file you need from one of these backups?

[Mobi]

when I backed up the whole system to an external disk - approx every 2 weeks

Now I am completely lost - why don't you just restore the file you need from one of these backups?

Because my last full back up was on 31st October and the file in question was created after this date, between 5th and 10th November at which point I accidentally overwrote it.

Regarding the creation of restore points, I have no idea why, but I am getting them all the time now, every time I download, and sometimes even when I use a piece of software (if windows advise it is making a 'change' to the system). When I download a windows update, the first message that comes up is that the system is creating a restore point. It certainly wasn't working before, and I guess I'll never know why.

[Supernova]

Regarding the creation of restore points, I have no idea why, but I am getting them all the time now, every time I download, and sometimes even when I use a piece of software (if windows advise it is making a 'change' to the system). When I download a windows update, the first message that comes up is that the system is creating a restore point. It certainly wasn't working before, and I guess I'll never know why.

It's not supposed to do that. What changes did you make to the creation of restore points?

Edited November 13, 2010 by Supernova

[Mobi]

It's not supposed to do that. What changes did you make to the creation of restore points?

Yes it is:

"System Restore uses restore points to return your system files and settings to an earlier point in time without affecting personal files. Restore points are created automatically every week, and just before significant system events, such as the installation of a program or device driver. You can also create a restore point manually...."

Some (but not all) software is identified by W7 as 'making a change to the system', everytime it runs, usually when it checks for and downloads updates ( eg. Malaware)and W7 asks me if I approve the changes and now also creates a restore point.

It all seemed to have got triggered when I set up a manual restore point a few days ago, but my understanding is that it is now working normally. There is a facility for deleting all but the the most current restore point if I am concerned about disk space.

[lopburi3]

Correct - the whole idea of system restore is to go back if a system change causes a problem. It will always create a new restore point before making changes to Windows.

[lopburi3]

Because my last full back up was on 31st October and the file in question was created after this date, between 5th and 10th November at which point I accidentally overwrote it.

Didn't notice that in previous posts and had idea it was an old file you had just made updates to.

[Supernova]

I am getting them all the time now, every time I download,

File downloads shouldn't trigger the creation of restore points unless you choose to open executable files (.EXE or .MSI) immediately after the download completes. If restore points are being created each and everytime you download something, well, that's just overkill.

[Supernova]

Correct - the whole idea of system restore is to go back if a system change causes a problem. It will always create a new restore point before making changes to Windows.

Downloading files saving them to disk hardly qualifies as "making changes to Windows".

[Mobi]

I am getting them all the time now, every time I download,

File downloads shouldn't trigger the creation of restore points unless you choose to open executable files (.EXE or .MSI) immediately after the download completes. If restore points are being created each and everytime you download something, well, that's just overkill.

Sorry, I misled you. It is when I install the updates that it happens, but some software will trigger it just when I try to run it.

If you have W7 you will know that every time Windows detects a 'change ' to the OS. the screen will go very dark and a a pop up window tells you that you are about to make a change to the system and asks if you wish to continue?

This typically happens when you install new software,install updates to software, install windows updates and sometimes when you just run certain software (usually spy ware type packages).

It is after you click 'yes' that the restore point is created and is the way I believe it is designed to work.

If you are frequently playing with new software, as I sometimes do, then you will get a lot of restore points, but they can always be deleted.

[lopburi3]

Correct - the whole idea of system restore is to go back if a system change causes a problem. It will always create a new restore point before making changes to Windows.

Downloading files saving them to disk hardly qualifies as "making changes to Windows".

I was talking about making changes to your operating system (Windows). That is done when installing updates.

[siamect]

This is getting complicated...

I suggest you skip everything that has to do with restore points.

Separate your thnking into

1. system (can be reinstalled easily)

2 user data (all the value in your life)

1.If you really need to backup your system so you can get back to a certain point including the installed programs and settings, do a partition backup (one of the very few times a recommend partition backup) Clonezilla have the tools you need like Partclone. Use these programs on your own responsibility. I have not tested enough to have any opinion on their quality. Once you have done a partition backup, restore it immediately to a different disk and test it, so you know it works.

2. Separate your user data in folders, one for each project.

Use a distributed version control system if it fits your work (editing 2 hour HD video clips does not) and push regularly to a remote location.

If you for some reason don't want to use version control systems backup using the traditional daily,weekly, monthly or Towers of Hanoi rotation schemes.

Martin

Edited November 14, 2010 by siamect