On a Virtualbox WIN XP SP3 guest machine, the following situation occurred
While I was working I had 3 opened windows as usual - Browser, notepad for writing notes in a txt file, and a PDF (thats what i use 90% of the time when in this guest). While I was working and was in active window in the browser ALL OF a sudden the notepad window and the PDF viewer window closed, I minimized the browser to see whats happening, and saw that 70% of the stuff that was on my desktop has disappeared (ALL .TXT files ALL .PDF and some .png). I have checked folders and saw that every file with extension txt and pdf was deleted. I have immediately shutdown the system to prevent any data changes which can rewrite the deleted files and make problems further with retrieval. There arent really any programs in this guest as I use it only for browsing, viewing PDF and writing a lot of stuff in the plain text files, it doesnt even have java or flash installed. I dont have snapshots. I think regular methods for data recover can be used as like recovering from a shift+del delete or empty recycle bin or other unwanted delete.
I have tried 2 methods to retrieve data.
attached the VMDK to another virtual machine as a slave. On that other virtual machine i have previously installed Recuva and then scanned the attached disk. It showed me that all that data was truly erased and I can retrieve everything except the plain text files .txt . And there is the problem, I need those .txt files badly as they are of the big importance not the PDFs. Recuva showed the names of all the .txt files but it says they are 0 bytes and unrecoverable.
I mounted that VMDK into ZAR(zero assumption recovery). It scanned it, but the same results. It too cant recover the .txt files.
I know that the txt files have to be there and arent rewritten because when the deletion happened I have turned off the machine in about 2-3 minutes without making any changes to anything. I have made a backup copy of the entire VMDK before performing those 2 operations above. The container is fixed 20 GB but only has 9.8GB used.
How can I recover those plain text files as they are the most important thing for me and there arent any backups except in that drive, I can inspect them one by one manually if needed
P.S recovered everything and is not corrupted except all that is plain text files - the .txt files. Recovery programs show me theyre names but cant recover my written content inside. They are the most important and them I don't know how to retrieve
