That thought had crossed my mind. If I didn't have those references in the registry for recently run *.dvf files and also in the info2 I would think that they were messing with me. The unit was brand new, and the client had not copied files like this before, so there is plenty of room for user error, but everything registry related points that a folder was created on the clients desktop, then simply vanished???
was the file system fat32?
was the computer improperly shutdown? (IF YES, SEARCH THE PARTITION ROOT iside the folder "FOUND.???" for file fragments.
any trace of secure file deletion tools?
was the client browsing the internet, copying/burning CDs…… (etc? Ask the client questions ……for any traces of heavy disk I/O )
I assume you already have the disk image…
search standard "File signature" for
files. or create few small DVF files of your own in the text machine and search for few samples of uniq strings in the file header or footer of the dvf file. Then with few sample of signature search the whole hdd. for that UNIQ string (using ENCASE or dd?)
—>If it exist;
{ try recovering the file fragment (tlest) & using some dvf file recovery/repair software (google for it) try reparing the file with the utility.
if you cant find a utility to do so… create a standard file header/footer for the fragmented data & append the fragmented data in middle. this trick works for many file type; say wmv… if you can get the file header right (which is relatively simple & then append the fragmented/broken data even VLC player can play it with a breeze!
EITHER WAY let keep us updated about your success or failure in this case!
BEST OF LUCK )