So I had a wonderful morning at a client's business the other day. I got called for a simple backup of one file and reinstall after Windows 10 killed their HP AIO POS system. (both definitions of POS apply). I figured I'd just do the quickest route and USB boot to linux to grab the single file they needed to be saved (the latest .QPB file), through it onto the USB drive and reinstall Windows for them. However I was getting some odd behaviors I've never run into before with my live boots. The mouse would lock onto an object that I selected, and even after moving it would click my previous item. For instance I clicked SBA2 where the OS data partition was on the desktop, then go to click one of the folders from this folder, and as soon as I clicked it'd open another SBA2 folder. It was a fun issue that was really driving me crazy just trying to get to the Intuit folder.

Finally, I navigated to the Intiut folder after having to reboot several times when the mouse refused to behave correctly. I tried two separate live boots, on two separate USB drives I had, using both DEFT and puppy linux and kept getting this problem. I highlighted the main business folder for their quickbooks and moved it over to my drive. It seemed to freeze, and I noticed that only about 1/2 of the data had transferred to my drive. Odd, so I simply deleted the data from my drive and tried again. The problem was, I was still getting this crazy issue where the mouse kept thinking it was somewhere it wasn't, and it deleted my sources main quickbooks folder. Since it was a live CD, no luck checking the recycle bin, and I've tried a few data recovery programs including EaseUS and DMDE to try and find the now deleted .QPB files. With no luck, the only thing I get is some old .QPB files from May 2015 that reside in the Windows.OLD folder oddly enough.

So, I am wondering if any of you guys know of a program that can accurately hunt out the file signature for a QPB file, or if I need to do something different since I deleted a file from an NTFS drive while on a live CD (usb). Or, if I'm just crap out of luck and need to cut my losses. The clients saw how the mouse was acting crazy, so they are very understanding, but I'm now upset at myself that I didn't just take the extra 10 minutes to take apart the AIO and pull the drive, and would like to make it right instead of them having to recreate from scratch a new .QPB file.


TL;DR
Deleted a companies main QPB files from a Windows drive while on Puppy Linux live boot. How can I get it back?

Probably the mouse freezing, etc, could be a symptom of a bad HDD.
You should make an image of your original drive (you need to get it out of the HP) and try to search for the files using R-Studio, GDB, etc.
You also need to check if the drive health is OK or not.

On only deleted files (without any re-write on the HDD) you should find the files.

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner

Check the drive's SMART report with smartmontools. Look for reallocated, pending or uncorrectable sectors.

Clone the drive with ddrescue and then work on the clone.

_________________
A backup a day keeps DR away.

A SMART test is something I did before even booting into a live CD. As their original problem was they needed a reinstall since the Windows 10 update left them with a brick. I will try a more in depth sector scan on the drive.

I was specifically looking for a program that specializes or has high compatibility with the .QPB file signature. As again, I've already run it through dmde and easeus and get the same list of old .qpbs from a windows.old folder that can be normally accessed. It doesn't find the files I deleted from live CD.

Thank you for the replies.

Could it be that the tool you used to delete the files, made a secure erase??
If so, nothing to do I'm afraid...

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner