Win OS reinstall looses Program files including logs - GCM file found

[John Ralls]

> On Feb 4, 2015, at 9:04 PM, Mary Ann Wallace <wallace at naples.net> wrote:
> 
> My thanks and appreciation to John and David for their comments and advice.  Small progress has been made, but I ran into a problem that I hope can be solved.
> 
> A brief summary for those new to this post:  My Win7 Pro 32-bit hard drive failed 6 months ago.  An Acronis image had been created, a new drive subsequently installed and Gnucash is there but only with 6 months of data.  In the meantime, I had copied the Program Files from the Win7 to an external drive.  I was using that with a WinXP     netbook temporarily until I could get the Win7 fixed and thought the XP was accessing the external drive as I entered data to finish out 2014.  I discovered in January that the data was being saved to the XP C:/Program Files folder taking a screen shot and making a notation, but the XP itself failed without my backing up those files.  The only ones found were GCM files in My Documents and as I learned here, worthless in recovery. The technician restored the XP OS the same time he put a new hard drive on the Win7.  It wasn't until I got both of them back that I realized my Program Files were gone on the XP.   I was resigned to recreating the data when David suggested I take a look at TestDisk.
> 
> Re:  David's suggestion of TestDisk -  I was told by the technician:
>> doubt anything is recoverable, even on a sector by sector analysis.  The process used was the Acer WinXP recovery procedure with the option to not format the drive and to backup user data into a "Backup" directory.  Program Files is not in the user data area.
> However, this nagged at me and especially after looking at the website David recommended, I decided to try TestDisk myself and see if it was basic enough for me to follow.  The site had excellent screen shots showing what to do and a forum that I went to looking to see if someone had similar questions in using TestDisk that might have been answered.  When I ran testDisk, it showed thousands of deleted files because I forgot to specify a filter, but I was able to find:  gnuxmlaccounts.gnucash.20140917001406.gnucash.20141227191309.gnucash (76kb GNUCASH File 12/27/2014 7:13 PM) and a subsequent log file (1KB) with a 7:17 PM time stamp as well as all the gnuxmlaccounts.gnucash......preceding those that had been saved on the temporary WinXP I was using.  I copied them to a directory in My Documents and then copied them over to an external drive. 
> 
> Re:  John's instructions below to move files to My Documents. 
> 
> I went on my main computer Win7 Pro 32-bit, and made an Accounts folder in Documents and moved the old gnuxmlaccounts.gnucash... files to Accounts per John's advice.  I dismissed the error message John said would come up and it opened as of the old date in June.  I closed the program.
> 
> I copied the newly undeleted gnucash data files from my external drive to the Accounts folder, thinking this should work if I do the right steps.  I don't think I did.  I tried just clicking on the 12/27/14 7:13 PM file and the Gnucash program tried to open but had the following message:
> <BackendError.png>
> 
> I closed the program, reopened it trying to use the File Open and point to another of the gnucash files and got the following error message:
> 
> <GnucashParsingError.png>
> 
> The Program doesn't show you where it's going when it opens up.  The only way I found out was on a hunch when I detached my external drive.  If I open Gnucash in Win7 with my external drive attached, it opens up an old file on that drive that I had used on the Acer XP files dated 11/03/14 which has little new data from June since I only started getting caught up in November.  Very strange that the Win7 will look for the external drive when I've now put files in Accounts and even copied them back in Program Files.  If I remove the external drive, the message John points out comes up so I use File Open to point it at the 12/27/14 files but get the "No suitable backend found."  When I do a "File Open", the box looks like Word or Excel in that it lists 3 files.  the first and last are short gnucash files but the middle one is the 11/03 file that is not useful and that resides on the external drive.
> 
> Importing seems to be only for "log" files, which don't contain all the data that the regular ones do with warnings about importing the wrong log file.  It seems I have the later files and ought to be able to start up the program with them, but I just don't know how.
> 
> I copied for the time being all the data files that I had now placed in the Accounts data folder to the original location in Program Files to see if just working from the C:/Program Files would work like it did before.  But it still brings up old files and not the new ones.  So I've deleted them since they were copies of the ones I had moved to Accounts.  My current structure is external drive NOT attached, no data files in Program Files, data files in Accounts.
> 
> Is there an explanation of what I should do to be able to open the 12/27/14 files?  I feel I'm so close but just don't understand why it's not working.
> 
> Thanks for your help. 
> Mary Ann
> 
> Here is a snipit of late files:
> 
> 
> <DataDecember.png>

Mary Ann,

There’s nothing magic going on with the external drive. GnuCash saves the last 4 files you opened and displays them in the File menu, and unless directed otherwise (from the command line) will open  the most recently used on startup. If that’s on a removable drive and you remove the drive, it will put up a message box saying that it couldn’t find the file. 

GnuCash files are compressed by default, and if they’ve been damaged somehow the decompression code won’t be able to restore them. I think that’s likely in this case, but if you want to send one of them to me directly I’ll see if that’s what’s happened. Based on the fact that the “technician” restored your system without even reformatting the disk means that there’s nothing wrong with the disk itself and that a disk recovery company like the afore-mentioned DriveSavers can probably recover your data, albeit at considerable cost. They’re able to recover data even from sectors that have been overwritten, something they routinely do for law enforcement. Disk recovery programs like TestDisk or the far more famous original recovery program, Norton Utilities, aren’t able to do that. Every time you write something to the disk you risk overwriting sectors formerly used by those deleted files, corrupting them.

A note about the filenames of those files you recovered: gnuxmlaccounts.gnucash.20140917001406.gnucash.20141227191309.gnucash means that at some point you opened a backup file ( gnuxmlaccounts.gnucash.20140917001406.gnucash) and entered transactions into it. The three-month gap means either that you switched in September or that you may have missing transactions from September through December because you entered them in gnuxmlaccounts.gnucash.

Regards,
John Ralls