Profile madness

[NTFOOL]

I had a user who complained her Norton scans had stopped due to an out of disk space error message. Looking at her C drive I saw it was very low on free space and began cleaning up some files etc.
One area I thought I could gain some space in was user profiles. I saw three rather big profiles all labeled unknown user...as well I saw the profile I was logged in as in the list. I went and deleted the unknown users and right before my eyes all the users desktop shortcuts disappeared. After rebooting, the user logged back in to half a profile..some of the stuff was there (email settings, printers etc) and some of it was lost (desktop shortcuts to files and folders, as well as actual folders that were on the desktop)
How did this happen and does anyone know of a way to get this stuff back ? I was under the impression that you could not delete the profile you were actually logged in as but that is what apparently happened.

Any help is appreciated.

 

[wolluf]

Are you sure they were all 'unknown user' - sounds like you deleted the All Users profile (which is combined with your own profile to produce what goes on the desktop, in the start menu - so what you are seeing is consistent with that. Emails for example are stored in your own profile).

As to getting it back - you need a data recovery app (presuming you did a full delete - and they're not in recycle bin) - most cost money, and you'd be best slaving the drive to another machine if you want to do this (so this machine's operating system is not being used) - you'll need another drive or partition at least. Getdataback is a good one - there's a free one here (though I've had little success using it with ntfs filestore):-

http://www.pcinspector.de/file_recovery/UK/welcome.htm

 

[NTFOOL]

Thanks for the quick reply...I think I know what happened. I tracked down the fella who supported these machines before me.
This machine was originally on an NT Domain "Domain A" there was a need to move the machine over to an AD domain "Domain B" but retain old settings and be able to flip between domains.
What the guy did was get the machine on the new AD domain then overright in the registry the old profile login with his new AD sid.
This would of effectively moved the users settings over but in turn would have caused the old profile to be labled unknown. ( I dont think this is the M$ way of moving a profile over to a new domain).
Deleting that unknown profile would have wiped some of the settings that user was currently using.
This is more or less a guess on my part after talking with the guy and asking him what he did so I could be way off but it does make sense.
Just to touch on the deleting of the profile you mentioned the recycle bin...I deleted the profile through System properties, user profiles. The data never found its way into the recycle bin it was just gone so I am not sure it can be recovered.