Files Lost

Discussion in 'General Returnil discussions' started by TRSV, Mar 28, 2010.

Thread Status:
Not open for further replies.
  1. TRSV

    TRSV Registered Member

    Joined:
    Feb 14, 2010
    Posts:
    1
    I copied some important folders,files to C: drive and the entire folder is gone after reboot.

    I don't have a backup.

    Is there a way to recover lost folders.

    While copying files,I also noticed a new Z: drive, content of which was same as C: drive. Due to priority of the task that I was doing, I thought of investigating the Z drive issue later.

    After reboot there is no Z: drive either and the folders I created in C: drive are gone.

    I am an average user. I only installed this software because the Advanced System Care Home Edition software I use, prompted me to install this software.

    I haven't uninstalled this software yet and would like to know if there is a way to recover lost files.

    Thanks if anybody can help me on this.
     
  2. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Hello TRSV and welcome to the forums :)

    With RVS System Safe activated, all changes made to your System partition are lost at restart. Please see the following for a better understanding of what RVS is and does:

    RVS is a combination solution that combines Instant System Recovery (AKA: Boot-to-restore or System Level Virtualization) with antimalware (Virus Guard) and anti-executable (Main screen > Virus Guard > Additional protection options while using System Safe).

    So what does this all do?

    The System Safe feature is the Instant System Recovery virtualization that clones your real system partition (usually the C:\ drive) and prevents changes (malicious, unwise, and potentially unwanted) from being made to the real system. In other words, RVS System Safe presents Windows with a fantasy world where anything can happen, and like a dream, is gone at computer restart; leaving your computer clean. This feature can be used in two ways:

    1. On demand: Some users will leave the feature off and activate it when they are engaged in risky behavior (surfing the dark side of the internet, malware research, opening a website you are not certain of, etc). In this mode, it is called Session Lock where the virtualization is on only until the computer is restarted. To enable it, you do not have to restart so it functions as a "panic button" in a way.

    2. Always on: This is the most secure, but the user needs to make some adjustments in how they use their computer and save files and data. With all changes to the system partition being lost at restart of the computer, it is true that work, files, pictures, etc saved in areas like Documents, Pictures, Downloads, etc would not persist following said restart. For this reason, it is recommended to change your other program settings to save their output and data on a non-system drive or partition. So what is a non-system drive or partition?

    EX's:
    A. Data Drive D:\
    B. USB drive E:\
    C. Optical CD/DVD+_R drive F:\
    D. External drive or IEEE drive G:\
    E. RVS Virtual Drive Z:\

    RVS provides a convenience feature called the Virtual Drive (Tools > Virtual Drive) for those who do not have access to a non-system drive (has only a C:\ drive) without the need to partition your hard drive. It creates a large, empty file with special properties that makes Windows believe it is an actual drive. When opened (mounted), you can use it like another drive and files saved within it will remain following a restart of your computer with System Safe activated.

    ISR alone however can only do three things by itself:

    1. Drop all changes
    2. Save some changes
    3. Save all changes

    This means that malware, though completely removed from your computer at restart, can work as expected while in the virtual system. This is why we have combined the Virus Guard and anti-execute functions to ensure that the user can both block malicious content and get a warning of its presence so they can restart their computer and keep the time the malware was present to an absolute minimum. With just an Antivirus and/or other anti-what-have-you scanner, there is a good chance that malicious content would not be detected (scanners have at best a 30% to 50% average detection rate at any given time) and as a result can persist for days, weeks, and even years before it is discovered and eliminated from your computer with the obvious consequences to personal information or other issues. (Ref: Rustock C, Induc A, conficker/downadup).

    With RVS System Safe active, and even if the Virus Guard does not detect it, malware can only persist until the computer is restarted. This means that detection is akin to the canary in a coal mine and is much less important than ensuring your computer is clean.

    The System Safe virtualization needs to be turned off from time to time to allow:

    1. Microsoft Updates
    2. Hard disk defragmentation - This only needs to be done once when using RVS System Safe as the virtualization enforces and maintains the defragmented state of the real system. So anything you do has no effect on the long term performance of your computer
    3. File backups and computer images
    4. Installation and uninstallation of programs

    To deactivate System Safe (will be as though RVS is not installed as far as what happens on your computer):

    1. Open the RVS program
    2. On the main screen, click the System Safe section and then UNCHECK the "Enable System Safe when I start Windows"
    3. Restart your computer

    Once you restart, the RVS shield symbol in the toolbar and tray icon will be green rather than red.

    Mike
     
  3. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    993
    Location:
    Hawaii
    Where was the data before you copied it to the C drive? It might be possible to recover it from its original location.
     
  4. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Hi dantz,
    Perhaps, but it would need to be accomplished using forensic tools before the cache is overwritten or wiped...

    Mike
     
Thread Status:
Not open for further replies.