Help!! Deleted \AppData\Local\Temp\ folders

witefire180

I suspected I had a web app based virus and stupidly, without fully understanding the chrome environment, I deleted a bunch of folders in my C:\Users\witefire180\AppData\Local\Temp directory.

Folders had names like {89332B7C-8D72-4CB4-A23A-89D9F6A8715E} mostly and a few with names like chrome_drag6788_1407769498

Afterwards I did notice I probably halted all the running data for my current apps as Vivaldi and then notepad crashed afterwards

Panicking I reopened vivaldi (and I am hoping this was not a fatal mistake) to notice all my user data was gone. I closed vivaldi, restored all the temp folders I had deleted and reopend vivaldi. Of course nothing was restored as we know persistent user data is stored in C:\Users\witefire180\AppData\Local\Vivaldi\User Data

I had some chrome extension with very important data that I did not conventionally backup (stupid me I know) and would really like to try and get my bookmarks back.
Is either of these possible from the restored temp data? My traditional User Data directory in the vivaldi folder pretty much looks like fresh install and I am biting my nails/pulling my hair out to figure out if I can recover my data.

edit: I was able to find these lines in my debug log, I am guessing those errors are directly related to me deleting the temp folder, at least I can see a reference to a specific temp folder there. Just in case anyone is wondering I did replace my actual username on windows with my vivaldi account username.

*** 3.7.2218.55 ***
[0429/142017.348:INFO:update_notifier_manager.cc(561)] "C:\Users\witefire180\AppData\Local\Vivaldi\Application\update_notifier.exe"
[0429/142017.350:INFO:update_notifier_manager.cc(597)] Notifier already runs, will quit
[0430/020542.909:INFO:updatedownloader.cc(682)] Launching installer:
"C:\Users\witefire180\AppData\Local\Temp\VivaldiUpdate-oJYyuJAzX_9ufiqoTFchMg\11536_1632450687\Vivaldi.3.8.2259.37.x64.exe" --vivaldi-install-dir="C:\Users\witefire180\AppData\Local\Vivaldi" --vivaldi-update
[0430/020551.623:INFO:update_notifier_manager.cc(999)] Exit due to a quit event
[1221/122214.141:ERROR:registration_protocol_win.cc(134)] TransactNamedPipe: The pipe has been ended. (0x6D)
[1221/122214.143:ERROR:crash_report_database_win.cc(607)] CreateDirectory C:\Users\witefire180\AppData\Local\Vivaldi\User Data\Crashpad: The system cannot find the path specified. (0x3)
[1221/122214.464:ERROR:registration_protocol_win.cc(106)] CreateFile: The system cannot find the file specified. (0x2)
[1221/122217.356:ERROR:registration_protocol_win.cc(106)] CreateFile: The system cannot find the file specified. (0x2)
[1221/122217.455:ERROR:registration_protocol_win.cc(106)] CreateFile: The system cannot find the file specified. (0x2)
[1221/122224.142:ERROR:registration_protocol_win.cc(106)] CreateFile: The system cannot find the file specified. (0x2)

witefire180

If anyone knows about the AppData/Local/Vivaldi/File System folder, I seemed to be able to recover quite a bit of that with recuva but no luck finding any extensions folder

I was also able to recover quite a few .tmp files but not sure if I can find anything i need in there

mib2berlin

@witefire180
Hi, if you delete the temp files until Vivaldi was running you get these kind of problems.
If you have a backup you can restore all of the files in \AppData\Local\Vivaldi\User Data. The Application files doesn´t matter, you can simply reinstall Vivaldi.
The folder "Default" include all data you need, move the folder to a save place and copy the same folder from your backup instead.

Cheers, mib

Pathduck

@witefire180 Hello and Welcome to the Vivaldi Community

To bad to hear about the loss of your profile data, although it should not really happen even if you manage to delete the files in TEMP.

First, I'm guessing we can ignore the INFO messages from 0429 (29/4), and also I assume you've updated Vivaldi since 3.7 or 3.8?

Vivaldi does keep files in TEMP, named something like:
4e690604-2bdb-4f26-a746-dc36a1c8c2e4.tmp
But these are locked by the running application and should not be possible to delete. Unless maybe if you're running as Administrator (and I think not even then). And you should never be logged in as Administrator anyway, right?

I'm guessing the TransactNamedPipe ERROR and subsequent crash might be caused by deleting these files. It also ERRORs on CreateDirectory for creating CrashPad which is strange. Does the directory exist?

I can't really understand why your entire Vivaldi profile was nuked, it should not happen.

Was this during a Vivaldi update?

Are you absolutely sure the Default folder has been reset, that you're looking in the correct place?

You did not delete any other files or directories? Like in the actual Vivaldi profile folder?

If you were running Vivaldi Sync you have a good chance of restoring at least the most important data (passwords, bookmarks, notes).
https://help.vivaldi.com/desktop/tools/sync/

If anyone knows about the AppData/Local/Vivaldi/File System folder

That one is used for storing data from web sites (File System API) and is not critical for the browser to function.

What's important are the files directly under the profile, like:
Bookmarks
Login Data
Notes
Preferences
Secure Preferences

As well as the Local App Settings where Vivaldi keeps its settings. Most everything else can be recreated relatively easily, including extensions. Loss of cookies, history would not be a huge loss in such a situation.

I closed vivaldi, restored all the temp folders I had deleted

How exactly did you restore these? Using Recuva? You can't rely on such tools for critical data, they depend on pure luck if files have not been overwritten already. You need proper regular backups of data.

witefire180

Thank you for the replies, and sorry for the late reply. It seemed whatever I did triggered a full reinstallation including the preceding uninstallation which is what seems overwrote my needed extension data.

I did try a few basic recovery tools, and you are right Pathduck, honestly I don't know why many of those exist since they can do about as much as the OS itself. I honestly wouldn't pay for the recovery software that costs money, seems like a scam.

So I ended up booting up live linux and doing some real forensics/data recovery. I was able to search for an ASCII string that I knew would be in the file and was fairly unique in the raw data of my hard drive (independent of underlying filesystem) using Foremost, an amazing file carving digital forensics tool. Since I made sure not to download anything else on the hard drive or use it much, the data I was looking for was easily recovered this way.

I will be sure to follow the suggestions from you guys here and the several other backup options I seemed to have completely dismissed before this happened xD Thanks guys!

Pathduck

@witefire180 Hi - happy to hear you were able to at least save some of your files and that you have the know-how to use the right tools for the job

I honestly wouldn't pay for the recovery software that costs money, seems like a scam.

Funny thing is, I actually bought a license for Recuva a couple years back. I just liked the product and it seemed to do a decent job. BUT I think I can count on one hand the actual times it's been able to reliably recover a file... I guess Piriform can consider it a donation

using Foremost

Never heard of that - thanks for the tip, I'll be sure to remember it for when I need it (hopefully not any time soon).

backup options

Having a good backup routine is important, and can save a lot of time and frustration. What products to choose often comes down to personal preference in terms of complexity and features.

I use:
Areca Backup - For weekly incremental backups of important files (like documents and Vivaldi profile). Getting old now, no new releases for years, and relies on Java (ugh). But I like how it allows me to choose what version of a file to restore, the powerful filters (to exclude for instance cache folders and other backup size waste), and the option to make a test run to see what files will be backed up. I've not been able to find a good replacement that's not either overly simplistic or massively complicated to set up. It creates a command line shortcut that can be triggered using Task Scheduler instead of relying on an always-on service like other products.

AOMEI Backupper - For weekly backups of the system disk and monthly for programs disk. A Chinese company, but don't let that put you off - it's a solid software product and support+documentation is actually pretty decent should you need it. I like its speed and simplicity, that it can run a full-disk backup without shutting down the system, that it can be set to use the Task Scheduler, and it can do a system migration backup, for installing a backup on changed hardware.

AOMEI also has a really solid partition manager. Again, don't be put off by the shady-looking site, it's solid software (I am not in any way affiliated with this company )
https://www.diskpart.com/compare-edition.html

Because of doing weekly system backups (I've turned off the mostly useless and space wasting Restore Points), I've basically been running the same installed system since 2015. Upgraded from 8.1 to 10, but otherwise unchanged, never had to do a full reinstall. I've done several system restores of course - mostly due to my overly zealous cleaning of registry entries or files

The way I have the partitions set up - I never install software on C: - backups are kept small and fast. A full system disk backup takes a couple of minutes, while using the system, and file size is ~10GB.

Vivaldi Sync - while not really a backup, can also save your day if something bad happens. Just know that's it's a SYNC - so if you accidentally delete all your bookmarks while using Vivaldi then it will happily sync "user deleted all bookmarks". But for those times you've somehow nuked your V profile it can be a quick way to restore the important data like bookmarks and saved logins. But mostly if I mess up bad I just restore the most recent profile from backup.

Alinatait

This post is deleted!