Please Help - Ghost Document Anywhere? SOLVED

[shade-cabin-hammock]

Hi,

Oh, boy. I'm in a world of hurt here. Hope there's a way out.

Somehow, I started mis-saving an important PDF file to

C:\Users\user\AppData\Roaming\PixelMetrics\CaptureWiz\LastCaptures\

I uninstalled my old 5.4 version of that application.

That ALSO deleted the directory there it seems.

Did that yesterday.

I've got...10 days of work on that one file.

Using PDF-X, from time to time I've seen files that say "Broken version / broken file", or something like that on the left hand pane.

I've been using this particular PDF a LOT over the last few weeks. Is there ANYWHERE I could see if a version of it might have gotten saved or stored by PDF-X?

Please help!

Sincerely,

SCH

[shade-cabin-hammock]

In my terror-induced searching online I found this - about temporary files in Adobe. IS there any similar location for PDF-X?

Thanks!

SCH

[shade-cabin-hammock]

Hi,

OK! I can SEE the file in Windows Shadow Volume using this tool (https://www.nirsoft.net/utils/shadow_copy_view.html)

But...if I try to extract the file USING that tool, the formatting breaks in the copy-over:

So, ?seemingly?, if I can get a working app for reading shado copies I may be able to get the file?

Sincerely,

SCH

[shade-cabin-hammock]

And...the news gets worse:

https://www.reddit.com/r/sysadmin/comments/bujh82/files_restored_from_shadow_copy_corrupt/

Yes. I have seen this, on windows 10 as well, trying in despair to restore a file from C:\windows\CSC with a user who's Offline Files didn't sync... thought I was a hero, when I "mounted" one of the snapshots from vssadmin with mklink, and found the file, only to find out it was corrupted. Windows 10 , dropped the automatic full snapshots that Windows 7 had by default... I can only theorize that the snapshots that are there are for System Restore, and the non system files that are there, are placeholders or something...
It IS possible to make scheduled tasks that take REAL snapshots, real snapshots will still work on a workstation when "manually" done by a script, but yeah, I wasn't able to restore files as well by default...

So, I have a SHADOW copy of the file - indeed the whole drive. Hoping now there may be some location hidden among PDF-X's own structures that MAY have the file still?

Sincerely,

SCH

[Tracker Supp-Stefan]

Hello shade-cabin-hammock,

It's unlikely that we would have made a copy of the file if it closed correctly in the Editor.
You can try some "undelete" programs - the file data might be still on the drive. However I'd recommend that you use another machine to put any such undelete tool on e.g. a USB thumb drive, and then run it from the thumb, and check the drive where your file should have been.
Important files should ideally have backups on different hardware and not rely on windows restore features, as those can not be trusted 100% of the time, or might be aimed at a different type of restore as you are finding out.

Kind regards,
Stefan

[shade-cabin-hammock]

Hi Stefan,

Totally follow.

It's unlikely that we would have made a copy of the file if it closed correctly in the Editor.

On the OFF chance that maybe the file didn't save correctly - please could you share with me the location(s) on the drive where those files wind up?

Got the Undelete programs all cooking. You can't imagine the wee sufferring being able to SEE The file in the Shadow Volume...but knowing it's corrupted. Real heart break!

Hoping the PDF-X locations may, MAY have the hidden Easter Egg!

Sincerely,

SCH

[TrackerSupp-Daniel]

Hello, shade-cabin-hammock

Unfortunately, we do not make copies of the docuemnts, we work directly with the original file wherever it is located. The only temporary versions of anything we hold on to are the *.tmp files located in our %tmp%/PDFXEdit folder, and even those are basically a record of the changes (the same function you use with the "undo/redo" buttons), not a full copy of the document.
(Ie: It might record steps like, "select stamp 5 on page 3, move it 3 pixels to the left", but it will not record what that stamp looked like, or its size, or any of the other unaffected content on the page.)

I am afraid that in cases like this, there is nothing we can do to help you on our end.

Kind regards,

[David.P]

Hi all,

If shadow copies exist in that hard drive, file version management might be active on the PC. In this case, it might be possible to access one or more previous versions of that folder by right-clicking on the folder in question (or its still existing parent folder):



https://www.pcmag.com/how-to/how-to-back-up-restore-your-documents-in-windows-10

https://www.online-tech-tips.com/windows-10/how-to-restore-previous-versions-of-files-in-windows-10/#:~:text=Once File History is,using Windows File Explorer

[TrackerSupp-Daniel]

Thanks David! Hopefully that can help.

Kind regards,

[shade-cabin-hammock]

Hi Daniel and David,

Ah! Thanks both for replying!

David! That is sage advice. Didn't know that. Sadly...system is saying there's no other version. ...

Daniel, and David, too, please as I know you're Jedi-level with all things PDF-x - about a possible Easter Egg version, I think I explained poorly.

Please look at the image below. Form time-to-time I'll see this notice pop after closing a big file - Document Recovery

And! Interestingly, I've noticed it's seemingly persistent? In that, if I don't pro-actively click the wee garbage bin, the file will keep presenting itself.

Where is the path to Document Recovery files?

Sincerely,

SCH

[David.P]

Hello s-c-h,

I had an earlier thread about a Recovery issue, but I guess it doesn't add much information to what has already been said by Stefan and Daniel above:

https://forum.pdf-xchange.com/viewtopic.php?f=62&t=32656&hilit=recovery+path+temp#p138383

The Autorecovery folder's path is

Code: Select all

%tmp%/PDFXEdit

(copy this and paste it into the path box at the top of Windows Explorer)

Also, you've already come pretty far with the shadow copies. I would continue from there, trying to repair those found PDF(s) with a suitable PDF recovery tool.

Maybe start from here: https://alternativeto.net/software/pdf-fixer/about

Good luck -- losing many days of work is more than painful!

After years of occasionally also losing hours or sometimes days of work due to program crashes or not saving regularly, I have now reached a point of (healthy) paranoia where I upload the Autorecovery folders of programs like Word and PowerPoint to the cloud every few minutes, using a backup tool that directly sends the files to OneDrive, for example.

I should probably set this up for PDF-XChange editor as well....

Best regards
David

[Tracker Supp-Stefan]

Hello David.P,

Thanks for your input and sharing the folder!
Indeed there isn't much that we can do from our end unfortunately!

Kind regards,
Stefan

[shade-cabin-hammock]

Hi David P. & Stefan,

David P!
Wow! Thanks! Alas, the recovery tool seemed unable to render the Shadow Copy's file back to readability. I'll keep looking for similar tools.

AND! Thanks for the PATH!

To Stefan, AND David, please I'm seeing a LOT in the temp version from the Shadow Copy. Like SEVEN different directories. I'm thinking that one of them is for that huge document I was working on?

But, none of them seem to be whole files? Is there any way I can make this data come back to file versions?

Sincerely,

SCH

[David.P]

O.k., then I would proceed as follows.

1. Close PDF-XChange Editor
2. Delete all contents of the Auto Recovery folder %tmp%/PDFXEdit (or move them to some backup location)
3. Copy all contents from exactly one version of the diverse Auto Recovery folders, as recovered from the diverse Shadow Copies, to the recovery folder %tmp%/PDFXEdit
4. Open PDF-XChange Editor and switch on the Recovery Pane
5. Various document names should now appear in the Recovery Pane
6. Ideally these can then be restored by double-clicking:

Repeat the whole process, going backwards in time, with all available versions of the Auto Recovery folder from the Shadow Copies, until ideally the recovery process works for one version.

Note: this only works if there is a matching older version of the lost original document (having a similar but earlier modified date than shown in the Recovery Pane) in the folder that is displayed in the Document Recovery Pane (as I understand, this is the C:\Users\user\AppData\Roaming\PixelMetrics\CaptureWiz\LastCaptures\ folder here). If this is not the case, this or a similar error message will appear:



Therefore, should the original folder no longer exist, it must first be recreated in exactly the same place, and the latest available version of the original file with exactly the filename shown in the Recovery Pane should be placed there before starting the above recovery attempts.

Hth, and good luck
David

[shade-cabin-hammock]

Hi David P!,

W O W ! ! Next-LEVEL! Really.

Couple of questions, please. You wrote I should paste the CONTENTS of the directories. So, not the DIRECTORIES themselves, but what's inside.

AM I right?

Then, strangely...I can delete and clear out %tmp%/PDFXEdit, and move the files over. BUT...once I open the app, a WHOLE host of files appear in %tmp%/PDFXEdit and my copied over files are gone?

Like it goes from all empty to:

And, these files are undeleteable as they are all in-use?

But, when I close the app they all...disappear?

What do you think is happening?

Thanks!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

SCH

[David.P]

Either the contents of a recovered %tmp%/PDFXEdit folder must be placed in the original %tmp%/PDFXEdit folder; or the original %tmp%/PDFXEdit folder is to be deleted and to be replaced by one of the recovered %tmp%/PDFXEdit. It doesn't matter which variant to use, since in my experience that folder doesn't contain any hidden files that could be overlooked when using the first variant.

I also don't think that the files you copied over manually to the %tmp%/PDFXEdit folder are getting deleted. It is true that PDF-XChange Editor creates various files in that folder every time it is started, and that it deletes most of them again when the program ends. However, the files that were manually placed there beforehand should not be affected, in particular should not be deleted by PDF-XChange Editor.

Anyway, you should not primarily look at the files in that folder, but check the Recovery in Pane PDF-XChange Editor to see which files and recovery times/dates are displayed there, in order to try the corresponding recovery there.

[Timur Born]

Does ShadowCopyView only list one shadow copy to select from? Anyway, try using PreviousFilesRecovery instead, it is a bit easier to use and lists all versions of modified and deleted files found in shadow copies. You can also use search wildcards to pinpoint your filename down or search for all *.pdf files.

Search results look like this:

[shade-cabin-hammock]

Hi,

Ah! Thanks to ALL!

Sadly, I couldn't ever get the file to reassemble itself. ...

On the bright side, I dove back into it with a bit of forlorn gusto and managed, I think, to find most of what I found in the first go around, and maybe even a bit more.

Thanks again!

Sincerely,

SCH

[Paul - Tracker Supp]