Fokke Nauta wrote:
Hi all,
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a new
folder called PIETER with many documents in it. Lately he opened that
folder again, to create a new folder in it. I guess by the cause of
his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or Properties
- Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER?
By searching in the file explorer there was no result.
What I've seen before when people with shaky hands use a computer, is
that they inadvertently drag a folder inside another.
I'm worried that the shortcut elicits no response - normally it would
say "can't find target" or words to that effect.
Have you seen the problem for yourself, or is it what Pieter tells you
over the phone?
I suggest you investigate personally - go there, or get him to bring the laptop to you.
Searching from the root of the filesystem may help (typically C:\) but
you will need to make hidden and system files visible (temporarily)
since the folder may have been moved inside a hidden folder.
If it's been deleted, it should be possible to recover it from the
"Deleted items" folder.
There are only two classes of people in the world: those who have lost
files from a computer, and those who will.
So where is the backup?
Hi all,
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a new
folder called PIETER with many documents in it. Lately he opened that
folder again, to create a new folder in it. I guess by the cause of his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or Properties -
Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER? By searching in the file explorer there was no result.
Hi all,guess by the cause of his shaking hands, something went wrong and the folder PIETER has disappeared. Instead of that there was a shorcut named PIETER but it can't be opened. Neither by double clicking, nor by Open or Properties - Open file location.
A very strange problem here. An old friend of mine (80+) is using Windows 10 home on his laptop. In the Document folder he created a new folder called PIETER with many documents in it. Lately he opened that folder again, to create a new folder in it. I
Is there any chance we can open it or find the folder called PIETER? By searching in the file explorer there was no result.
Many thanks in advance.
Fokke Nauta
On 19/02/2023 15:30, Graham J wrote:
Fokke Nauta wrote:
Hi all,
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a new
folder called PIETER with many documents in it. Lately he opened that
folder again, to create a new folder in it. I guess by the cause of
his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or Properties
- Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER?
By searching in the file explorer there was no result.
What I've seen before when people with shaky hands use a computer, is
that they inadvertently drag a folder inside another.
That's what I thought as well. In the file explorer I looked in the
Documents folder and searched for PIETER. No such folder found. So I
assumed it's gone. Hence the shortcut with the same name.
I'm worried that the shortcut elicits no response - normally it would
say "can't find target" or words to that effect.
Yes, indeed. But no response at all.
Have you seen the problem for yourself, or is it what Pieter tells you
over the phone?
I use Teamviewer to look into his laptop. I have been looking and
searching myself remotely.
I suggest you investigate personally - go there, or get him to bring the laptop to you.
Searching from the root of the filesystem may help (typically C:\) but
you will need to make hidden and system files visible (temporarily)
since the folder may have been moved inside a hidden folder.
I did!
If it's been deleted, it should be possible to recover it from the
"Deleted items" folder.
It's not in there.
There are only two classes of people in the world: those who have lost files from a computer, and those who will.
So where is the backup?
On a stick. But he will loose the recent changed documents.
Thanks!
Fokke
In article <k5eqmfF6avpU1@mid.individual.net>, Fokke Nauta wrote...
On 19/02/2023 15:30, Graham J wrote:
Fokke Nauta wrote:
Hi all,
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a new >>>> folder called PIETER with many documents in it. Lately he opened that
folder again, to create a new folder in it. I guess by the cause of
his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or Properties >>>> - Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER?
By searching in the file explorer there was no result.
What I've seen before when people with shaky hands use a computer, is
that they inadvertently drag a folder inside another.
That's what I thought as well. In the file explorer I looked in the
Documents folder and searched for PIETER. No such folder found. So I
assumed it's gone. Hence the shortcut with the same name.
I'm worried that the shortcut elicits no response - normally it would
say "can't find target" or words to that effect.
Yes, indeed. But no response at all.
Have you seen the problem for yourself, or is it what Pieter tells you
over the phone?
I use Teamviewer to look into his laptop. I have been looking and
searching myself remotely.
I suggest you investigate personally - go there, or get him to bring the >>> laptop to you.
Searching from the root of the filesystem may help (typically C:\) but
you will need to make hidden and system files visible (temporarily)
since the folder may have been moved inside a hidden folder.
I did!
If it's been deleted, it should be possible to recover it from the
"Deleted items" folder.
It's not in there.
There are only two classes of people in the world: those who have lost
files from a computer, and those who will.
So where is the backup?
On a stick. But he will loose the recent changed documents.
Thanks!
Fokke
Have you examined the shortcut? Right-click and pick "Properties", and you should see the target of the shortcut.
Might give you a clue. One of the
options for moving a file (when you right-click and drag) is to save a shortcut
to the (unmoved) file in the target location.
On 2/19/2023 8:22 AM, Fokke Nauta wrote:
Hi all,
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a new
folder called PIETER with many documents in it. Lately he opened that
folder again, to create a new folder in it. I guess by the cause of
his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or Properties
- Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER?
By searching in the file explorer there was no result.
Many thanks in advance.
Fokke Nauta
nfi.exe is in here (3,772,278 byte ZIP).
In the nfi folder. nfi.exe is 21,744 bytes. You would
have to copy nfi.exe out of the ZIP file, for later usage.
https://web.archive.org/web/20070104083656if_/http://download.microsoft.com:80/download/win2000srv/utility/3.0/nt45/en-us/oem3sr2.zip
In an Administrator Command Prompt window, run something like:
cd /d C:\users\pieter\Downloads\ # presumed location of unpacked nfi.exe
nfi.exe c: > nfi_c_out.txt # we will assume pieter-folder has moved somewhere
# on the same partition, but
we don't know where
notepad nfi_c_out.txt # search for the
pieter-folder in here
Now, let us look in the file for the item.
File 8641
\Users\pieter\Downloads\pieter-folder <=== where I originally created it
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident) <=== this is what makes it a directory
Mere data files don't have
that line
If I accidentally drag and drop it to the Desktop, the
file entry looks like this. The item may be invisible
on the desktop (sometimes the coordinates of an icon, are off-screen).
But this tells us, we have not lost it.
File 8641
\Users\pieter\Desktop\pieter-folder <=== it was dropped onto the desktop
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident)
OK, now I will throw the file in the trash and look for it.
This requires re-running the nfi command, after move to trash.
Now, the file cannot be found, because it is "encoded". Notice
though, that the file number has not changed (this does not
help Pieter though, in his quest -- it just helps me figure out
where it went). The filenum has not changed, but the path is
tricksy.
File 8641 \$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001\$RWZXS4P
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident)
The 1111111111-2222222222-3333333333 is my account number, the
1001 is the short number for it (user accounts start at 1000,
the administrator account if enabled is 500).
From the command prompt in that administrative window,
you can see that the folder has more structure than
you can see in File Explorer. There is irrelevant junk
in there, as long as the two items I'm looking for.
cd /d C:\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001\
dir
Volume in drive C is W11HOME
Volume Serial Number is FA6E-E6DA
Directory of C:\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001
11/17/2022 02:21 PM 90 $IB1E2YM
05/24/2022 08:10 AM 162 $IORC0QG
02/16/2023 12:10 AM 116 $IWYYHPC
02/19/2023 09:50 AM 106 $IWZXS4P <=== hmmm. what is
in here ?
05/24/2022 08:10 AM 160 $IZOMNAN.html 06/25/2022 06:43 PM <DIR> $RTP3338
02/19/2023 09:40 AM <DIR> $RWZXS4P <=== this is
pieter-folder
5 File(s) 634 bytes
2 Dir(s) 60,838,133,760 bytes free
$IB1E2YM: data
$IORC0QG: data
$IWYYHPC: data
$IWZXS4P: data <=== no hint yet, as to what this is $IZOMNAN.html: data
$RTP3338: directory
$RWZXS4P: directory
desktop.ini: Windows desktop.ini
This doesn't work. I probably wasn't elevated at the time.
notepad C:\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001\$IWZXS4P
But with an elevated hex editor, we get some idea of what the pointer
to the file looks like. If we were to put back the file
which is in the Recycle bin, this file is consulted as
to the location where the file belongs when restored.
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000010 00 00 00 00 43 00 3A 00 . ...C.:.
00000020 5C 00 55 00 73 00 65 00 72 00 73 00 5C 00 70 00 \.U.s.e.r.s.\.p. 00000030 69 00 65 00 74 00 72 00 5C 00 44 00 6F 00 77 00 i.e.t.r.\.D.o.w. 00000040 6E 00 6C 00 6F 00 61 00 64 00 73 00 5C 00 70 00 n.l.o.a.d.s.\.p. 00000050 69 00 65 00 74 00 65 00 72 00 2D 00 66 00 6F 00 i.e.t.e.r.-.f.o. 00000060 6C 00 64 00 65 00 72 00 00 00 l.d.e.r...
OK, so what we've got, is a suspicious date stamp, and two files
$IWZXS4P <=== encoding file with path info (including pieter-folder name) 106 bytes
$RWZXS4P <=== the lost folder
Documentation example, here:
https://content-calpoly-edu.s3.amazonaws.com/cci/1/documents/ccic_forensics_manual/CCIC%20Chapter%207%20-%20Recycle%20Bin.pdf
You'll notice the junk in my Recycle bin for the example,
only the recently lost item has a pair of references. The
broken attempts at deletion, left half the materials behind
for the other items.
*******
So all we can hope, as a starting position, is Pieter lost
the folder on the desktop. Using Notepad on the NFI output
file, should reveal exactly where it went.
File 8641
\Users\pieter\Desktop\pieter-folder <=== it was dropped onto the desktop
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident)
If there is some monkey-business in the Recycle Bin, first we
look in there with File Explorer and hope it is visible like
it should be!
Paul
Hi all,use a search app like Everything and search a file name he remembers as
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a new
folder called PIETER with many documents in it. Lately he opened that
folder again, to create a new folder in it. I guess by the cause of his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or Properties -
Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER? By searching in the file explorer there was no result.
Many thanks in advance.
Fokke Nauta
Fokke Nauta wrote:
Hi all,
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a new
folder called PIETER with many documents in it. Lately he opened that
folder again, to create a new folder in it. I guess by the cause of
his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or Properties
- Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER?
By searching in the file explorer there was no result.
What I've seen before when people with shaky hands use a computer, is
that they inadvertently drag a folder inside another.
I'm worried that the shortcut elicits no response - normally it would
say "can't find target" or words to that effect.
Have you seen the problem for yourself, or is it what Pieter tells you
over the phone?
I suggest you investigate personally - go there, or get him to bring the laptop to you.
Searching from the root of the filesystem may help (typically C:\) but
you will need to make hidden and system files visible (temporarily)
since the folder may have been moved inside a hidden folder.
If it's been deleted, it should be possible to recover it from the
"Deleted items" folder.
There are only two classes of people in the world: those who have lost
files from a computer, and those who will.
So where is the backup?
On 2/19/2023 8:22 AM, Fokke Nauta wrote:
Hi all,use a search app like Everything and search a file name he remembers as
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a new
folder called PIETER with many documents in it. Lately he opened that
folder again, to create a new folder in it. I guess by the cause of
his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or Properties
- Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER?
By searching in the file explorer there was no result.
Many thanks in advance.
Fokke Nauta
being in PIETER.
On 2/19/2023 9:30 AM, Graham J wrote:
Fokke Nauta wrote:What someone attributed to "shaky hands" I call mouse droppings. I
Hi all,
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a
new folder called PIETER with many documents in it. Lately he opened
that folder again, to create a new folder in it. I guess by the cause
of his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or
Properties - Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER?
By searching in the file explorer there was no result.
What I've seen before when people with shaky hands use a computer, is
that they inadvertently drag a folder inside another.
I'm worried that the shortcut elicits no response - normally it would
say "can't find target" or words to that effect.
Have you seen the problem for yourself, or is it what Pieter tells you
over the phone?
I suggest you investigate personally - go there, or get him to bring
the laptop to you.
Searching from the root of the filesystem may help (typically C:\) but
you will need to make hidden and system files visible (temporarily)
since the folder may have been moved inside a hidden folder.
If it's been deleted, it should be possible to recover it from the
"Deleted items" folder.
There are only two classes of people in the world: those who have lost
files from a computer, and those who will.
So where is the backup?
have accidentally moved many files in this way..
Why it is a good idea to search for "Peter" it is possible that it got
moved to the main area on the disk, so search for it from C:/ or the partial name of that file. ie "PET"
Also ask what was the name of the file he was going to open and search
the C:/ for that file, or partial name of the file.
As suggested check the Properties, of the new short cut, it is possible
that the name of the directory is corrupted.
On 2/19/2023 8:22 AM, Fokke Nauta wrote:
Hi all,
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a new
folder called PIETER with many documents in it. Lately he opened that
folder again, to create a new folder in it. I guess by the cause of
his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or Properties
- Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER?
By searching in the file explorer there was no result.
Many thanks in advance.
Fokke Nauta
nfi.exe is in here (3,772,278 byte ZIP).
In the nfi folder. nfi.exe is 21,744 bytes. You would
have to copy nfi.exe out of the ZIP file, for later usage.
https://web.archive.org/web/20070104083656if_/http://download.microsoft.com:80/download/win2000srv/utility/3.0/nt45/en-us/oem3sr2.zip
In an Administrator Command Prompt window, run something like:
cd /d C:\users\pieter\Downloads\ # presumed location of unpacked nfi.exe
nfi.exe c: > nfi_c_out.txt # we will assume pieter-folder has moved somewhere
# on the same partition, but
we don't know where
notepad nfi_c_out.txt # search for the
pieter-folder in here
Now, let us look in the file for the item.
File 8641
\Users\pieter\Downloads\pieter-folder <=== where I originally created it
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident) <=== this is what makes it a directory
Mere data files don't have
that line
If I accidentally drag and drop it to the Desktop, the
file entry looks like this. The item may be invisible
on the desktop (sometimes the coordinates of an icon, are off-screen).
But this tells us, we have not lost it.
File 8641
\Users\pieter\Desktop\pieter-folder <=== it was dropped onto the desktop
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident)
OK, now I will throw the file in the trash and look for it.
This requires re-running the nfi command, after move to trash.
Now, the file cannot be found, because it is "encoded". Notice
though, that the file number has not changed (this does not
help Pieter though, in his quest -- it just helps me figure out
where it went). The filenum has not changed, but the path is
tricksy.
File 8641 \$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001\$RWZXS4P
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident)
The 1111111111-2222222222-3333333333 is my account number, the
1001 is the short number for it (user accounts start at 1000,
the administrator account if enabled is 500).
From the command prompt in that administrative window,
you can see that the folder has more structure than
you can see in File Explorer. There is irrelevant junk
in there, as long as the two items I'm looking for.
cd /d C:\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001\
dir
Volume in drive C is W11HOME
Volume Serial Number is FA6E-E6DA
Directory of C:\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001
11/17/2022 02:21 PM 90 $IB1E2YM
05/24/2022 08:10 AM 162 $IORC0QG
02/16/2023 12:10 AM 116 $IWYYHPC
02/19/2023 09:50 AM 106 $IWZXS4P <=== hmmm. what is
in here ?
05/24/2022 08:10 AM 160 $IZOMNAN.html 06/25/2022 06:43 PM <DIR> $RTP3338
02/19/2023 09:40 AM <DIR> $RWZXS4P <=== this is
pieter-folder
5 File(s) 634 bytes
2 Dir(s) 60,838,133,760 bytes free
$IB1E2YM: data
$IORC0QG: data
$IWYYHPC: data
$IWZXS4P: data <=== no hint yet, as to what this is $IZOMNAN.html: data
$RTP3338: directory
$RWZXS4P: directory
desktop.ini: Windows desktop.ini
This doesn't work. I probably wasn't elevated at the time.
notepad C:\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001\$IWZXS4P
But with an elevated hex editor, we get some idea of what the pointer
to the file looks like. If we were to put back the file
which is in the Recycle bin, this file is consulted as
to the location where the file belongs when restored.
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000010 00 00 00 00 43 00 3A 00 . ...C.:.
00000020 5C 00 55 00 73 00 65 00 72 00 73 00 5C 00 70 00 \.U.s.e.r.s.\.p. 00000030 69 00 65 00 74 00 72 00 5C 00 44 00 6F 00 77 00 i.e.t.r.\.D.o.w. 00000040 6E 00 6C 00 6F 00 61 00 64 00 73 00 5C 00 70 00 n.l.o.a.d.s.\.p. 00000050 69 00 65 00 74 00 65 00 72 00 2D 00 66 00 6F 00 i.e.t.e.r.-.f.o. 00000060 6C 00 64 00 65 00 72 00 00 00 l.d.e.r...
OK, so what we've got, is a suspicious date stamp, and two files
$IWZXS4P <=== encoding file with path info (including pieter-folder name) 106 bytes
$RWZXS4P <=== the lost folder
Documentation example, here:
https://content-calpoly-edu.s3.amazonaws.com/cci/1/documents/ccic_forensics_manual/CCIC%20Chapter%207%20-%20Recycle%20Bin.pdf
You'll notice the junk in my Recycle bin for the example,
only the recently lost item has a pair of references. The
broken attempts at deletion, left half the materials behind
for the other items.
*******
So all we can hope, as a starting position, is Pieter lost
the folder on the desktop. Using Notepad on the NFI output
file, should reveal exactly where it went.
File 8641
\Users\pieter\Desktop\pieter-folder <=== it was dropped onto the desktop
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident)
If there is some monkey-business in the Recycle Bin, first we
look in there with File Explorer and hope it is visible like
it should be!
Paul
On 2/19/2023 8:22 AM, Fokke Nauta wrote:I guess by the cause of his shaking hands, something went wrong and the folder PIETER has disappeared. Instead of that there was a shorcut named PIETER but it can't be opened. Neither by double clicking, nor by Open or Properties - Open file location.
Hi all,
A very strange problem here. An old friend of mine (80+) is using Windows 10 home on his laptop. In the Document folder he created a new folder called PIETER with many documents in it. Lately he opened that folder again, to create a new folder in it.
Is there any chance we can open it or find the folder called PIETER? By searching in the file explorer there was no result.use a search app like Everything and search a file name he remembers as being in PIETER.
Many thanks in advance.
Fokke Nauta
On 2/19/2023 2:13 PM, Zaidy036 wrote:I guess by the cause of his shaking hands, something went wrong and the folder PIETER has disappeared. Instead of that there was a shorcut named PIETER but it can't be opened. Neither by double clicking, nor by Open or Properties - Open file location.
On 2/19/2023 8:22 AM, Fokke Nauta wrote:
Hi all,
A very strange problem here. An old friend of mine (80+) is using Windows 10 home on his laptop. In the Document folder he created a new folder called PIETER with many documents in it. Lately he opened that folder again, to create a new folder in it.
Is there any chance we can open it or find the folder called PIETER? By searching in the file explorer there was no result.use a search app like Everything and search a file name he remembers as being in PIETER.
Many thanks in advance.
Fokke Nauta
Everything.exe from voidtools, lists the things it can access.
You don't have to install it fully, in the search sense. It
can be run like this.
everything.exe -create-file-list D:\temp\every_c.txt C:\
What that does, is list all the files and folders. The syntax
varies between versions, and you have to be patient while it
runs (because Windows Defender may be interfering with the run).
The command prompt runs immediately, but you may have to watch
Task Manager to tell what it is doing.
Everything.exe differs from NFI.exe, in that it lists hardlinked
files by both their filenames. NFI.exe only lists one of the two
filenames on a hardlinked file. The difference, around 30,000 entries,
is equal to all the files and folders in C:\Windows\WinSxS folder.
Everything.exe then, makes a list humans can use.
Paul
filetime.exe 1332131748228506471D944AD 3CB7D057
On 2/19/2023 2:13 PM, Zaidy036 wrote:
On 2/19/2023 8:22 AM, Fokke Nauta wrote:
Hi all,use a search app like Everything and search a file name he remembers
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a
new folder called PIETER with many documents in it. Lately he opened
that folder again, to create a new folder in it. I guess by the cause
of his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or
Properties - Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER?
By searching in the file explorer there was no result.
Many thanks in advance.
Fokke Nauta
as being in PIETER.
Everything.exe from voidtools, lists the things it can access.
You don't have to install it fully, in the search sense. It
can be run like this.
everything.exe -create-file-list D:\temp\every_c.txt C:\
What that does, is list all the files and folders. The syntax
varies between versions, and you have to be patient while it
runs (because Windows Defender may be interfering with the run).
The command prompt runs immediately, but you may have to watch
Task Manager to tell what it is doing.
Everything.exe differs from NFI.exe, in that it lists hardlinked
files by both their filenames. NFI.exe only lists one of the two
filenames on a hardlinked file. The difference, around 30,000 entries,
is equal to all the files and folders in C:\Windows\WinSxS folder.
Everything.exe then, makes a list humans can use.
Paul
Hi all,
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a new
folder called PIETER with many documents in it. Lately he opened that
folder again, to create a new folder in it. I guess by the cause of his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or Properties -
Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER? By searching in the file explorer there was no result.
Many thanks in advance.
Fokke Nauta
The problem has been solved. My friend could remember a file name of a document which was in the folder PIETER. He searched for it and found
the document. It was still in the folder PIETER, which was now found in
a sub folder under the folder Pictures. Haven't got a clue as to how he managed to do so. But now I'm sure that an old man with shaky hands and Windows don't fit.
Thank you all for your help and responses. I learned someting new again.
On 2/19/2023 6:01 PM, Paul wrote:
On 2/19/2023 2:13 PM, Zaidy036 wrote:
On 2/19/2023 8:22 AM, Fokke Nauta wrote:
Hi all,use a search app like Everything and search a file name he remembers
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a
new folder called PIETER with many documents in it. Lately he opened
that folder again, to create a new folder in it. I guess by the
cause of his shaking hands, something went wrong and the folder
PIETER has disappeared. Instead of that there was a shorcut named
PIETER but it can't be opened. Neither by double clicking, nor by
Open or Properties - Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER?
By searching in the file explorer there was no result.
Many thanks in advance.
Fokke Nauta
as being in PIETER.
Everything.exe from voidtools, lists the things it can access.
You don't have to install it fully, in the search sense. It
can be run like this.
everything.exe -create-file-list D:\temp\every_c.txt C:\
What that does, is list all the files and folders. The syntax
varies between versions, and you have to be patient while it
runs (because Windows Defender may be interfering with the run).
The command prompt runs immediately, but you may have to watch
Task Manager to tell what it is doing.
Everything.exe differs from NFI.exe, in that it lists hardlinked
files by both their filenames. NFI.exe only lists one of the two
filenames on a hardlinked file. The difference, around 30,000 entries,
is equal to all the files and folders in C:\Windows\WinSxS folder.
Everything.exe then, makes a list humans can use.
Paul
The timestamps in the every_c.txt are not readable directly.
"C:\Users\username\Downloads\Everything.ini",20318,133213174822850647,133213174822850647,32
I have a little utility, if they need conversion.
filetime.exe 1332131748228506471D944AD 3CB7D057
02/19/2023 16:58:02.285 <=== proof that a recently created file is roughly correct
********************************* filetime.c *********************************
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <Windows.h>
#include <WinBase.h>
int main(int argc, char *argv[])
{
FILETIME timein;
SYSTEMTIME stUTC, stLocal;
DWORD dwRet;
long long int arrgh;
int conv1;
/* typedef struct _FILETIME { = 131679807063691748;
DWORD dwLowDateTime; 1D3D216 0x3C1F91E4
DWORD dwHighDateTime;
timein.dwLowDateTime = 0x3C1F91E4;
timein.dwHighDateTime = 0x01D3D216; */
if (argc != 2) goto later;
if ( (conv1 = sscanf(argv[1], "%I64d", &arrgh)) == 0) goto later;
timein.dwLowDateTime = (unsigned int) 0xFFFFFFFF & arrgh;
timein.dwHighDateTime = (unsigned int) 0xFFFFFFFF & (arrgh >> 32);
printf("%X %X\n", timein.dwHighDateTime, timein.dwLowDateTime);
FileTimeToSystemTime(&timein, &stUTC);
SystemTimeToTzSpecificLocalTime(NULL, &stUTC, &stLocal);
printf("%02d/%02d/%d %02d:%02d:%02d.%03d\n",
stLocal.wMonth, stLocal.wDay, stLocal.wYear,
stLocal.wHour, stLocal.wMinute,
stLocal.wSecond, stLocal.wMilliseconds);
later: return 0;
}
********************************* end filetime.c *********************************
Paul
On 19/02/2023 14:22, Fokke Nauta wrote:I have done that and I don't have shaky hands, I call it mouse dribble
Hi all,
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a new
folder called PIETER with many documents in it. Lately he opened that
folder again, to create a new folder in it. I guess by the cause of
his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or Properties
- Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER?
By searching in the file explorer there was no result.
Many thanks in advance.
Fokke Nauta
Hi all,
The problem has been solved. My friend could remember a file name of a document which was in the folder PIETER. He searched for it and found
the document. It was still in the folder PIETER, which was now found in
a sub folder under the folder Pictures. Haven't got a clue as to how he managed to do so. But now I'm sure that an old man with shaky hands and Windows don't fit.
Thank you all for your help and responses. I learned someting new again.
Fokke
On 2/20/2023 6:42 AM, Fokke Nauta wrote:
On 19/02/2023 14:22, Fokke Nauta wrote:I have done that and I don't have shaky hands, I call it mouse dribble
Hi all,
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a
new folder called PIETER with many documents in it. Lately he opened
that folder again, to create a new folder in it. I guess by the cause
of his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or
Properties - Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER?
By searching in the file explorer there was no result.
Many thanks in advance.
Fokke Nauta
Hi all,
The problem has been solved. My friend could remember a file name of a
document which was in the folder PIETER. He searched for it and found
the document. It was still in the folder PIETER, which was now found
in a sub folder under the folder Pictures. Haven't got a clue as to
how he managed to do so. But now I'm sure that an old man with shaky
hands and Windows don't fit.
Thank you all for your help and responses. I learned someting new again.
Fokke
with I accidentally move a file.
Thank you for taking the time to help your friend.
Fokke Nauta wrote:
[snip]
The problem has been solved. My friend could remember a file name of a
document which was in the folder PIETER. He searched for it and found
the document. It was still in the folder PIETER, which was now found
in a sub folder under the folder Pictures. Haven't got a clue as to
how he managed to do so. But now I'm sure that an old man with shaky
hands and Windows don't fit.
Thank you all for your help and responses. I learned someting new again.
Worrying that Search did not find PIETER.
Since this is a laptop does the old man use the built-in trackpad, or a separate mouse?
I find the trackpads think I have tapped when I haven't, so the first
thing I do is to disable tapping. Sometimes it's difficult to find
where to do this - if you can't ask here, quoting the manufacturer and
model number of the laptop.
An ordinary mouse can be as litle as £5 from your local supermarket.
Well worth getting one.
You can then configure its sensitivity to only
respond to gross movements.
A cork floor tile makes an the ideal
mouse-mat.
I know several 80+ age users who have no difficulty with a mouse. Does
your friend have an underlying medical condition which causes the shaky hands? There may be people who can recommend an alternative to a mouse.
It is of couse possible to drive a Windows computer without using a
mouse - the tab and arrow keys will do everything you need. I learnt to
do this in the early days of PCs before a mouse was a widely available device. It's often quicker, and certainly more accurate than a mouse.
On 19/02/2023 14:22, Fokke Nauta wrote:
Hi all,
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a new
folder called PIETER with many documents in it. Lately he opened that
folder again, to create a new folder in it. I guess by the cause of
his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or Properties
- Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER?
By searching in the file explorer there was no result.
Many thanks in advance.
Fokke Nauta
Hi all,
The problem has been solved. My friend could remember a file name of a document which was in the folder PIETER. He searched for it and found
the document. It was still in the folder PIETER, which was now found in
a sub folder under the folder Pictures. Haven't got a clue as to how he managed to do so. But now I'm sure that an old man with shaky hands and Windows don't fit.
Thank you all for your help and responses. I learned someting new again.
Fokke
On 20/02/2023 13:02, Graham J wrote:
An ordinary mouse can be as litle as £5 from your local supermarket. Well worth getting one.
Well, he has one.
On 2/20/2023 12:54 PM, Fokke Nauta wrote:
On 20/02/2023 13:02, Graham J wrote:
An ordinary mouse can be as litle as £5 from your local supermarket.
Well worth getting one.
Well, he has one.
Mouse switches wear out. And when you do a drag with a
worn left-mouse, you can end up dropping the item part
way along your attempted travels.
What happens, is the plastic post that presses on the
switch plunger, wears, and no longer properly depresses
the plunger. Making the switch "noisy".
I have a mouse here, that drops folders all over the place
and it has been retired.
As for the search problem, there are several ways to search,
and you should set up a thorough search for Pieter (so he
can find the lost stuff the next time).
Windows Federated Search (Control Panels : Indexing Options)
Agent Ransack Mythic Software (free version), methodical search
Everything.exe Voidtools (free), scans and keeps lists
nfi.exe Not a search tool, does not list WinSxS
materials properly.
Paul
On 2/20/2023 6:42 AM, Fokke Nauta wrote:
On 19/02/2023 14:22, Fokke Nauta wrote:
Hi all,
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a
new folder called PIETER with many documents in it. Lately he opened
that folder again, to create a new folder in it. I guess by the cause
of his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or
Properties - Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER?
By searching in the file explorer there was no result.
Many thanks in advance.
Fokke Nauta
Hi all,
The problem has been solved. My friend could remember a file name of a
document which was in the folder PIETER. He searched for it and found
the document. It was still in the folder PIETER, which was now found
in a sub folder under the folder Pictures. Haven't got a clue as to
how he managed to do so. But now I'm sure that an old man with shaky
hands and Windows don't fit.
Thank you all for your help and responses. I learned someting new again.
Fokke
If using Everything note that under "Search" there is a choice of what
one is looking for: Document, Folder, Executable, etc.
On 21/02/2023 01:45, Paul wrote:
On 2/20/2023 12:54 PM, Fokke Nauta wrote:
On 20/02/2023 13:02, Graham J wrote:
An ordinary mouse can be as litle as £5 from your local supermarket. Well worth getting one.
Well, he has one.
Mouse switches wear out. And when you do a drag with a
worn left-mouse, you can end up dropping the item part
way along your attempted travels.
What happens, is the plastic post that presses on the
switch plunger, wears, and no longer properly depresses
the plunger. Making the switch "noisy".
I have a mouse here, that drops folders all over the place
and it has been retired.
As for the search problem, there are several ways to search,
and you should set up a thorough search for Pieter (so he
can find the lost stuff the next time).
Windows Federated Search (Control Panels : Indexing Options)
Agent Ransack Mythic Software (free version), methodical search
Everything.exe Voidtools (free), scans and keeps lists
nfi.exe Not a search tool, does not list WinSxS materials properly.
Paul
Thanks, Paul.
Perhaps a new mouse?
Fokke
On 2/21/2023 3:11 AM, Fokke Nauta wrote:
On 21/02/2023 01:45, Paul wrote:
On 2/20/2023 12:54 PM, Fokke Nauta wrote:
On 20/02/2023 13:02, Graham J wrote:
An ordinary mouse can be as litle as £5 from your local
supermarket. Well worth getting one.
Well, he has one.
Mouse switches wear out. And when you do a drag with a
worn left-mouse, you can end up dropping the item part
way along your attempted travels.
What happens, is the plastic post that presses on the
switch plunger, wears, and no longer properly depresses
the plunger. Making the switch "noisy".
I have a mouse here, that drops folders all over the place
and it has been retired.
As for the search problem, there are several ways to search,
and you should set up a thorough search for Pieter (so he
can find the lost stuff the next time).
Windows Federated Search (Control Panels : Indexing Options)
Agent Ransack Mythic Software (free version),
methodical search
Everything.exe Voidtools (free), scans and keeps lists
nfi.exe Not a search tool, does not list
WinSxS materials properly.
Paul
Thanks, Paul.
Perhaps a new mouse?
Fokke
Maybe. It would be up to Pieter to rate the current mouse
for wear characteristics. You would normally see that you
had dropped a folder while in the process of dragging it.
It is only the odd time, that when the folder slips,
it is dropped into an unknown area.
My mouse the other day, I thought software was messing
with my scroll wheel. Got the screwdriver and opened it
up, and it just needed a cleaning. The scroll wheel was
filthy.
Where they hide the screws, varies with generation. At
one time, screws were hidden under rubber feet. Now, the
screws could be under some "stickers", and the stickers
have some cut-lines indicating a screw is underneath. You
might need a jewelers Philips (cross) screwdriver to get
the screw out. The screw is in plastic, so you have to be
careful to not over-tighten when finished the cleaning.
Do not pull at the poly sliders or rubber feet, unless
you are absolutely certain a screw is under there. You cannot
remove any sliders too many times, as the adhesive on them
will fail.
Some mice have a lot of parts inside, such as tiny
springs. The first time I took the mouse apart, some
of the springs fell out, and I couldn't figure out
their orientation. I put the parts away for a
rainy day, and a second attempt to reassemble worked.
My newest mouse has been apart for a cleaning (a Microsoft
brand mouse), and the scroll wheel bearing is very impractical
to clean. If you get a gummy substance in there, you cannot
disassemble the bearing for cleaning.
But that's the joy of owning these mice. In the old days,
the rubber-ball mice needed to be cleaned practically
every day. These newer optical mice need a cleaning
every five years (button area inside and scroll wheel).
And five years passes in no time. When you have the mouse
apart, you can check for wear on the post that pushes
the mouse button microswitch plunger. Since the amount
of wear is tiny, you compare left-mouse to right-mouse,
as they have different amounts of wear and that helps
you detect the wear. This one seems to use a "pad" to push
on the plunger, and you can see the "pad" has a depression
in it from usage.
https://oscarliang.com/wp-content/uploads/2021/09/fix-mouse-double-clicking-replace-switch-open-case.jpg
The array-light-detector IC is always made from a weird plastic,
and it looks like the company making them does not know how
to mold plastic, but do not let that bother you, as the
chip seems to be quite reliable. Movement of the mouse
is detected by comparing pixel values as the image
impressed on them moves over the sensor. Normally, the
light array sensor does not need to be cleaned.
The owner of that mouse is lucky, in that it is a five button mouse,
and you can unsolder one of the two spare switches and keep
the three button portion working (that's if a mouse plunger
is not working right). The other two buttons may never have
received a "binding" by the OS and that's why they are "spare".
Paul
On 19/02/2023 14:22, Fokke Nauta wrote:
Hi all,
A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a new folder called PIETER with many documents in it. Lately he opened that folder again, to create a new folder in it. I guess by the cause of his shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or Properties - Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER? By searching in the file explorer there was no result.
Many thanks in advance.
Fokke Nauta
Hi all,
The problem has been solved. My friend could remember a file name of a document which was in the folder PIETER. He searched for it and found
the document. It was still in the folder PIETER, which was now found in
a sub folder under the folder Pictures. Haven't got a clue as to how he managed to do so. But now I'm sure that an old man with shaky hands and Windows don't fit.
Thank you all for your help and responses. I learned someting new again.
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 297 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 01:53:04 |
| Calls: | 6,666 |
| Calls today: | 4 |
| Files: | 12,212 |
| Messages: | 5,335,597 |
