options for recovery of third party software unexpected win reboot

Bree · 13 Jun 2019

zbook said:

Does anything happen to the potentially recoverable files during each reboot?

Things do get written to the hard drive in a normal boot: log files, the swap file, the event log, the user profile, etc.

There is a chance that some sectors of the files you wish to recover may get overwritten. How big a risk, I cannot say - probably small. But I can say that there is no risk if you boot from something else.

That's why I'd recommend booting from something like a recovery drive usb that you can make on another PC. The files from the portable Recuva .zip file can be copied to a folder on the boot usb and started from the command prompt.

How come using Kyhi is needed?

It's not necessary, but it would make life easier. A recovery drive usb + recuva will do the job, but KyHi's disk has a convenient Windows GUI with Recuva (and other tools) on the Desktop.

zbook · 13 Jun 2019

There are three flash drives that are currently available:
1) 125 GB USB3 non bootable with HP hardware diagnostics (115 GB free)
2) 64 GB USB2 bootable windows 10 iso build 1703 with other builds that are not bootable (13.3 GB free)
3) 32 GB USB2 bootable Kyhi boot rescue (28 GB free)

The problematic computer displayed:
KB4503327, KB4503308, KB4465065 all installed on 6/12
KB4494441, KB4497932, KB4499405 all installed on 6/10

The computer had remained always on in hibernation (rarely used in the past 60 days)
There were unexpected windows updates.

The Recuva was downloaded to another computer.
Extract all was clicked.
Recuva64 is in view to click or copy and paste to a flash drive.

The Recuva software had not ever been used.
How does the performance vary if
a) it's downloaded to the problematic computer's downloads folder then clicking extract all then running the software versus
b) rebooting the problematic computer using kyhi boot rescue then launching Recuva versus
c) copying and pasting recuva64 to one of the flash drives and running the software from the nonbootable flash drive

Addendum:
Just ran a trial run on another computer.
It displayed 38,491 files in 11.66 sec (there was an option for a deeper scan taking > 1 hour which was not checked.
There were some listed that were unrecoverable, excellent, poor and very poor.
It displayed for the best results, restore files to a different drive.

There is TB HD available.

On the problematic computer should the quick or > 1 hour scan be performed?
If it displays excellent then recover?
How about if it displays poor or very poor?

SIW2 · 14 Jun 2019

zbook said:

Does anything happen to the potentially recoverable files during each reboot?
The computer is expected to have a normal boot.
How come using Kyhi is needed?
Why not use recuva from the downloads folder? or possibly USB?

Windows is constantly writing to disk. If you want to recover files, your chances are better if you don't boot it up.

zbook · 14 Jun 2019

Windows had performed an automatic reboot after the updates and the computer had remained on.

a) The computer can be left on and recuva downloaded. Then ran from the download folder?

b) Alternatively on another computer the software can be copy/pasted to a flash drive. Then ran from the flash drive on the problematic computer?

c) Alternatively the problematic computer can be rebooted using Kyhi boot rescue. Then run recuva from the preinstalled desktop software.

Which seems like the better option? Or do they have minor differences?