Getting Outlook files off a corrupted hard drive:

May 2, 2005 7:35 AM

An extremely malicious malware/adware program has rendered my C: drive inoperable. I have a second hard drive in the closet, which I can connect as the C: drive, install XP onto, and then connect the old C drive as the D drive and copy some vital files over. Can I get most of my data safely this way?

The happened at the worst possible time: about an hour before a monthly backup on the first of the month. So the major things I need to get that aren't already saved are some photoshop files and a month's worth of Outlook e-mail. The PS files I'm not worried about, but I've never transferred Outlook data without making a *.pst file- which I clearly don't have this time around.

As for the spyware, I'm not worried about it as long as it's not the startup drive- it bascially just took over the startup files and was designed to re-install if any files are deleted. So once I get my data I can nuke the drive from orbit.

The entire event caught me off guard, leaving me with no backups or backup utility disks. (and the program was smart enough to escape Ad-Aware, NAV, and XP firewall.) I just want to figure out if this is a safer method than trying to do an XP repair install, which is my only other option- but I'm worried could overwrite some of the data files I want to save.

posted by XQUZYPHYR to computers & internet (12 comments total)

I do basically the same thing with slaving my old drive every time I buy a bigger one. Never had a problem. I always copy from the old drive and paste to the new one, rather than move the data. Saw a bad data loss incident with a cut-and-paste network transfer once. Don't know it if could happen drive-to-drive, but I don't like to take chances.
posted by Cyrano at 8:10 AM on May 2, 2005

Slaving the old drive is the way to go.

Run this to avoid future spyware infections. It's way better that AdAware etc.

Don't worry about the "genuine check", you can opt out and still download.
posted by stevejensen at 8:51 AM on May 2, 2005

You could try running a Knoppix CD, which is bootable and should recognize your hard disk and allow you to copy files from it to a USB disk, or a CD writer, or to a shared network disk. This would probably be less time-consuming than reinstalling XP, though it sounds like you intend to do that anyway. Good luck!
posted by odinsdream at 8:55 AM on May 2, 2005

Okay, glad to hear the slaving option is a safe bet, but my issue with Outlook still applies... are the individual messages saved anywhere on the drive, or am I SOL without an archived file of the e-mails? I have a month-old *.pst from the last backup, but can I get anything from beyond that if it's just stuck somewhere in the old hard drive where Office was installed?
posted by XQUZYPHYR at 9:15 AM on May 2, 2005

Is booting off of your 2nd drive and running a spyware check on the first drive an option? AFAIK, the reason you're ready to nuke this HD is because you can't clean it right, so this would seem to be a better solution (if it is possible) than copying over some files that you think you remember you need.
posted by michaelkuznet at 9:45 AM on May 2, 2005

IIRC, Outlook stores all data as a .PST file natively; it doesn't require an export to get data into a PST. Unless you are connecting to an Exchange server, but if that were teh case, then you wouldn't have a problem :).

Have you looked in one or the other of these locations: (I can't remember which is the default location)

C:\Documents and Settings\%USERNAME%\Application Data\Microsoft\Outlook

OR

C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Microsoft\Outlook

Or search for *.PST or even better, search for *.* and sort by date. Then you can just grab any and all data modified after your last backup.
posted by misterbrandt at 9:50 AM on May 2, 2005

Is booting off of your 2nd drive and running a spyware check on the first drive an option? AFAIK, the reason you're ready to nuke this HD is because you can't clean it right, so this would seem to be a better solution (if it is possible) than copying over some files that you think you remember you need.

I don't think so. The spyware (I don't remember the name and can't check anymore, but one of its features is creating a little icon of a dog's head in the taskbar) has an amazing feature where if its program is deleted, it automatically replicates itself. In addition, if you close any of the half--dozen programs connected to it from the task manager, they're scripted to automatically start running again, under a different filename that's randomly generated. I ran ad-aware seven times, and it kept finding and deleting a differently-named file of the exact same size. I actually did get through a clean bill of health after running Ad-Aware, NAV, and SpyBot while in safe mode with the internet disabled, and as soon as I restarted and plugged in the network cable the popups came back, followed by the entire program starting to force-reinstall itself. It's not a matter of "not cleaning it right;" the adware is literally designed to not be removable.

Some time on Google revealed some answers to deleting it, but the overall procedure would take almost as long as reformatting the entire drive anyway. Since it's only been a month since I installed clean anyway, it's honestly easier. The second drive is the same size and speed as the other, only about a year older, so it's not much of an issue swapping them out.

misterbrandt- I'll only find out after switching the drives and searching, but if that's the case then I might just be home free- thanks.
posted by XQUZYPHYR at 10:03 AM on May 2, 2005

The spyware won't run at all from the second drive if you boot from a clean drive, no matter how sneaky it is. Running the spyware check from a clean OS install on the second drive should clean it up.
posted by odinsdream at 10:06 AM on May 2, 2005

As to stevejensens' recommendation of the Microsoft Anti-Spyware program, I would just like say: proceed with caution.

There were significant problems with it a few months ago. I don't know the current status. CastleCops and Spyware Warrior are two helpful blogs that also have numerous Spyware forums.

Eric L. Howes conducted a study in October 2004 with interesting results.
posted by MLIS at 10:46 AM on May 2, 2005

I, like odinsdream, recommend using a Linux LiveCD to recover everything on the drive. I'm no Linux zealot by any means, but let me tell you that I've made hundreds of dollars recovering the data of people in predicaments just like yours.

I recommend downloading and making a CD of:

Mepis or Knoppix (I prefer Mepis)

Once you've burned the disc image onto a CD, boot up your machine off of that disc.

You will be able to see your hard drive (assuming you still have it connected and in your machine. Get all the precious data on your messed up hard drive and use the burning program to put it all on CDs.

Then you can wipe your hard drive or try other methods.

Otherwise, if you wanted to slave up your current drive, it might end up being a total pain. You have to make sure that the spare drive is the master drive, you have to wipe the spare drive, install an OS on it to boot off of, transfer all the data you want onto it, quit, make your other drive the master again, wipe it, install an OS on it, and transfer all the data back.

If you have LOTS of data, you want to do it the pain-in-the-ass way, but if you don't ... if you have a few CDs worth of data, use those Linux CDs.
posted by redteam at 3:13 PM on May 2, 2005

If you're planning to install the OS on a fresh drive anyway, I'd say the slave drive route is the easier one. If you were planning to re-install on the current drive, then redteam's approach would be easier. (And I am a Linux zealot by some means.)
posted by Zed_Lopez at 4:58 PM on May 2, 2005

misterbrandt is absolutely correct - Outlook's data is stored natively in PST format. The latest versions store the files in the C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Microsoft\Outlook folder.

You'll probably have Outlook.pst (your current mail, contacts and calendar appoinments), Archive.pst (archived versions of the above if you use the AutoArchive feature) plus a .pst file for any other mailboxes you have - for example, I also have a Hotmail.pst file.

To re-import them into Outlook:

File > Import and Export > Import from another program or file > Personal Folder File (.pst) > find file on your HD > Import items into the same folder in: Personal Folders > Finish.

I'd recommend copying the .pst files onto your new drive before you do this.
posted by blag at 4:18 PM on May 3, 2005