Returnil and lost files recovery

Hello,
I have an older version of Returnil installed (from 2007), which uses my memory cache for its operation.

Assuming that I got sophisticated file-recovery programs - is it possible to recover a lost file which has been accidentally downloaded while Returnil was on (and of course has not been saved properly at another partition)?

If this is possible, should I search for that file at its original folder where it was downloaded, or alternately where exactly should I search for that file?

Thank you

 

Hi gooliver and welcome to the forums

You are up against two barriers here:

1. The cache
2. where that cache is located

In the version you are looking at in memory caching mode, part of the tracking is dome in RAM with the rest being tracked internally within the RVS program itself. Further, RVS is the only thing that can access the cache outside of using forensic tools to examine the disk at a very low level.

This does not mean you would not be able to recover the file contents in theory, but in practice it may be very difficult; and the further out in time you go, the more difficult to impossible this may become due to overwrite within the cache itself.

My advice here if the file contents are of sufficient value would be to use a disaster recovery solution that can read and recover files at the disk level or to seek assistance from a specialist disaster recovery engineering firm.

Both have potential expenses attached to them with the first being the cost of the recovery solution and the second being VERY expensive...

Mike

 

Hi,

I am just new to these forums so i hope i can get some help!

My brothers XP machine had been running Returnil 2008 and has just been corrupted with the Black Screen of Death even though the mouse can still be moved, we cant launch Explorer.exe at all. So the PC is alive, but in a Coma like state because it can or wont respond to anything.

Whilst i think that my last resort is to rebuild the PC, i need to recover 2 imports file types that i can find through a deep search.

1. the 1gb Outlook.pst file, however when i go into the Application Data, i see a smaller outlook.pst file which clearly isnt the 1gb pst file i need to copy.

When i try to copy the 1gb file i get the error mesage that " I dont have Permission or the file or disk is locked"

I have tried using Recuva recovery software, but this shows that the file is there and not deleted or overwritten, but i cant copy or move it.

2.*.DAT file for a MYOB Accounting software. Again, this file is in the system albeit Windows says it was untouched since 2005. I know that this or a similar file was accessed on the 9/9/2011 but where is it?

Could these be in the Returnil Virtual System?

Ifso, please help me bring them back or access them?

Thanks in advance.

 

Hi GLO and welcome to the forums

Have you tried slaving the Hard Drive from your Brother's system to another test computer you have handy? If you can slave it, you should be able to extract the files you need that way. You can also try using a Linux boot CD/USB and then try to extract the files you are looking for.

One question on the files you mention not being as large or accessed in the time frame you expect, is there a possibility that he saved this content to the Returnil Virtual Drive? If yes, the missing content may actually be stored within the VD (This is different than the virtual mode)

The VD is a very large file named RVSYSTEM.IMG and will be located in one of the Returnil folders in program data or application data.

If this is valid, you would need to extract the IMG file and then import it into another system that has a copy of RVS installed. Keep the same name and put it in the exact same folder on the test system that you got it from the problem system. Next, open the RVS GUI and mount the virtual disk to get at any files it may contain.

Mike