How do I recover files from a (deleted) temporary profile in Windows 10?

Question

In the process of changing my username on my Windows 10 computer, I logged on as a temporary user. Out of ignorance, I moved all my important files to the default profile folder (which of course was temporary), thinking that it would be my new profile folder. Strangely, there are five temporary user profiles left on the machine, but all of them are empty except for the last one (TEMP.CLABE45.003), but that one has only one level of folders and no subdirectories or files. I tried using recuva on them, but none of these files were found. What do I do to recover them?

Solution

As far as I know files from temp accounts in windows 10 get deleted once you sign out. If it's the "regular" deletion process the content of the file is still there. So you should be able to recover it. Although you should scan the whole drive not just the existing directories.

IMPORTANT: Don't use the hard drive any more until you recovered you're files from it!! Use a different windows installation on a different drive to access it for the recovery or use a "bootable emergency CD" etc.

Here's why: Although the content of the file is still on the harddrive it will be marked as "empty space" so it eventually will be used for the content of new files. Meaning the content from you're deleted files will be overwritten and you won't be able to recover it any more.

Comments

[clabe45]

I don't have access to a different windows installation, what should I do? I do have a different computer, could I use an enslaving device?

[Albin]

You either need a second computer to which you can attach your harddrive or which you can use to download and create bootable medium with recovery tools. You can create it on the faulty system as well, but this might result in even more data that's being lost.

[clabe45]

So I take out my faulty computer's harddrive, put it in the enslaving device and use it with my good computer (I haven't used the device much)?

[Albin]

yes, that would work. Just be carefull not to write anything to the "faulty" hard drive (to make sure, you can make an image or use a "enslaving device" that has a write protection feature). The less you "used" the faulty drive the better the chance you still will be able to recover you're files (of course still assuming windows "only" deleted them the "normal" way and didn't for example overwrite them with zeros).

[clabe45]

so I can shut down my faulty computer and that won't overwrite anything?

[Albin]

No, the shut down will write all sorts of files on the hard disc giving you less change of recovering the lost files. I would suggest to press the power button for a few seconds or disconnect the power, this will just turn off the system without giving windows the chance to write anything else. The longer you run windows the lower the chance you can recover your files. Especially if you use software like your browser etc.

[TontyTon]

You can also boot your faulty computer with a bootable USB drive (windows to go) and try to recover files. Scan the whole drive, on which you lost the data.