Restoring files from C:\_RESTORE\TEMP

[johnwrig]

My first post here, hope this isnt too obscure. I have a WinMe system where a virus has erased many files. It appears that many of the erased files have been actually moved to C:\_RESTORE\TEMP and renamed Annnnnnn.CPY, much as Norton's Undelete moves erased files to a special directory and renames them. I understand that the C:\_RESTORE directory is used for ME's "System Restore" and that the TEMP directory usually holds copies of files that have been changed in a system update or software installation. I suppose it makes sense that deleted files would simply be moved to this directory. I imagine that the intention was to pack the files from TEMP into a CAB file but this never happened. I understand that only system & program related files are affected by System Restore.

So my question, is there an easy way to move all these files back where they were (like a Norton's Undelete util)? Preferably without disturbing other areas of the hard disk? SR must keep a list somewhere of what these files were...could this list be obtained as a text file?

Many thnaks in advance for any help with this admittedly odd question.

 

[xkjdhdg]

You can try downloading a trial copy of and undelete program.
You might try System Mehcanic!
What files are you trying to restore that would not be in the restore directory?

 

[smitee]

johnwrig

This article may not help you achieve your aim but may shed some light on a possible solution. Discussion of C:\_Restore\Temp files starts in the second message of the thread. IIRC the thread is (40+) articles.

smitee

 

[smitee]

I see from my post above I failed to provide a link... X-)

When we recovered our machine from Magister infection we disabled System Restore which purges the _Restore folder. Whether SR is enabled or not the _restore folder is recreated because SFP also uses it for critical system file protection.

From My Computer•Properties•Performance•File System•Troubleshooting•Check "Disable System Restore"•Apply and OK out. Allow reboot and _Restore file will be dumped.
Repeat and Uncheck "Disable System Restore". Apply and allow reboot. Then alter settings as you wish.

Third party tolls System Restore Remover Pro

http://www.majorgeeks.com/article.php?sid=516

Interesting article for manually disabling System Restore and associated _Restore folder.
Disable System Restore as show above. Disable "*statemgr" in Startup from Msconfig. Reboot and your done.
The _Restore folder will be created each time however.

http://www.markusjansson.net/eienbid.html

smitee