Hi all,

A very strange problem here. An old friend of mine (80+) is using
Windows 10 home on his laptop. In the Document folder he created a new
folder called PIETER with many documents in it. Lately he opened that
folder again, to create a new folder in it. I guess by the cause of his
shaking hands, something went wrong and the folder PIETER has
disappeared. Instead of that there was a shorcut named PIETER but it
can't be opened. Neither by double clicking, nor by Open or Properties -
Open file location. Simply no response.
Is there any chance we can open it or find the folder called PIETER? By
searching in the file explorer there was no result.

Many thanks in advance.

Fokke Nauta

Fokke Nauta wrote:
> Hi all,
>
> A very strange problem here. An old friend of mine (80+) is using
> Windows 10 home on his laptop. In the Document folder he created a new
> folder called PIETER with many documents in it. Lately he opened that
> folder again, to create a new folder in it. I guess by the cause of his
> shaking hands, something went wrong and the folder PIETER has
> disappeared. Instead of that there was a shorcut named PIETER but it
> can't be opened. Neither by double clicking, nor by Open or Properties -
> Open file location. Simply no response.
> Is there any chance we can open it or find the folder called PIETER? By
> searching in the file explorer there was no result.

What I've seen before when people with shaky hands use a computer, is
that they inadvertently drag a folder inside another.

I'm worried that the shortcut elicits no response - normally it would
say "can't find target" or words to that effect.

Have you seen the problem for yourself, or is it what Pieter tells you
over the phone?

I suggest you investigate personally - go there, or get him to bring the
laptop to you.

Searching from the root of the filesystem may help (typically C:\) but
you will need to make hidden and system files visible (temporarily)
since the folder may have been moved inside a hidden folder.

If it's been deleted, it should be possible to recover it from the
"Deleted items" folder.

There are only two classes of people in the world: those who have lost
files from a computer, and those who will.

So where is the backup?

--
Graham J

On 19/02/2023 15:30, Graham J wrote:
> Fokke Nauta wrote:
>> Hi all,
>>
>> A very strange problem here. An old friend of mine (80+) is using
>> Windows 10 home on his laptop. In the Document folder he created a new
>> folder called PIETER with many documents in it. Lately he opened that
>> folder again, to create a new folder in it. I guess by the cause of
>> his shaking hands, something went wrong and the folder PIETER has
>> disappeared. Instead of that there was a shorcut named PIETER but it
>> can't be opened. Neither by double clicking, nor by Open or Properties
>> - Open file location. Simply no response.
>> Is there any chance we can open it or find the folder called PIETER?
>> By searching in the file explorer there was no result.
>
> What I've seen before when people with shaky hands use a computer, is
> that they inadvertently drag a folder inside another.

That's what I thought as well. In the file explorer I looked in the
Documents folder and searched for PIETER. No such folder found. So I
assumed it's gone. Hence the shortcut with the same name.

> I'm worried that the shortcut elicits no response - normally it would
> say "can't find target" or words to that effect.

Yes, indeed. But no response at all.

> Have you seen the problem for yourself, or is it what Pieter tells you
> over the phone?

I use Teamviewer to look into his laptop. I have been looking and
searching myself remotely.

> I suggest you investigate personally - go there, or get him to bring the
> laptop to you.
>
> Searching from the root of the filesystem may help (typically C:\) but
> you will need to make hidden and system files visible (temporarily)
> since the folder may have been moved inside a hidden folder.

I did!

> If it's been deleted, it should be possible to recover it from the
> "Deleted items" folder.

It's not in there.

> There are only two classes of people in the world: those who have lost
> files from a computer, and those who will.
>
> So where is the backup?
>

On a stick. But he will loose the recent changed documents.

Thanks!

Fokke

On 2/19/2023 8:22 AM, Fokke Nauta wrote:
> Hi all,
>
> A very strange problem here. An old friend of mine (80+) is using Windows 10 home on his laptop. In the Document folder he created a new folder called PIETER with many documents in it. Lately he opened that folder again, to create a new folder in it. I guess by the cause of his shaking hands, something went wrong and the folder PIETER has disappeared. Instead of that there was a shorcut named PIETER but it can't be opened. Neither by double clicking, nor by Open or Properties - Open file location. Simply no response.
> Is there any chance we can open it or find the folder called PIETER? By searching in the file explorer there was no result.
>
> Many thanks in advance.
>
> Fokke Nauta

nfi.exe is in here (3,772,278 byte ZIP).

In the nfi folder. nfi.exe is 21,744 bytes. You would
have to copy nfi.exe out of the ZIP file, for later usage.

https://web.archive.org/web/20070104083656if_/http://download.microsoft.com:80/download/win2000srv/utility/3.0/nt45/en-us/oem3sr2.zip

In an Administrator Command Prompt window, run something like:

cd /d C:\users\pieter\Downloads\ # presumed location of unpacked nfi.exe

nfi.exe c: > nfi_c_out.txt # we will assume pieter-folder has moved somewhere
# on the same partition, but we don't know where

notepad nfi_c_out.txt # search for the pieter-folder in here

Now, let us look in the file for the item.

File 8641
\Users\pieter\Downloads\pieter-folder <=== where I originally created it
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident) <=== this is what makes it a directory
Mere data files don't have that line

If I accidentally drag and drop it to the Desktop, the
file entry looks like this. The item may be invisible
on the desktop (sometimes the coordinates of an icon, are off-screen).
But this tells us, we have not lost it.

File 8641
\Users\pieter\Desktop\pieter-folder <=== it was dropped onto the desktop
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident)

OK, now I will throw the file in the trash and look for it.
This requires re-running the nfi command, after move to trash.
Now, the file cannot be found, because it is "encoded". Notice
though, that the file number has not changed (this does not
help Pieter though, in his quest -- it just helps me figure out
where it went). The filenum has not changed, but the path is
tricksy.

File 8641
\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001\$RWZXS4P
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident)

The 1111111111-2222222222-3333333333 is my account number, the
1001 is the short number for it (user accounts start at 1000,
the administrator account if enabled is 500).

From the command prompt in that administrative window,
you can see that the folder has more structure than
you can see in File Explorer. There is irrelevant junk
in there, as long as the two items I'm looking for.

cd /d C:\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001\

dir

Volume in drive C is W11HOME
Volume Serial Number is FA6E-E6DA

Directory of C:\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001

11/17/2022 02:21 PM 90 $IB1E2YM
05/24/2022 08:10 AM 162 $IORC0QG
02/16/2023 12:10 AM 116 $IWYYHPC
02/19/2023 09:50 AM 106 $IWZXS4P <=== hmmm. what is in here ?
05/24/2022 08:10 AM 160 $IZOMNAN.html
06/25/2022 06:43 PM <DIR> $RTP3338
02/19/2023 09:40 AM <DIR> $RWZXS4P <=== this is pieter-folder
5 File(s) 634 bytes
2 Dir(s) 60,838,133,760 bytes free

$IB1E2YM: data
$IORC0QG: data
$IWYYHPC: data
$IWZXS4P: data <=== no hint yet, as to what this is
$IZOMNAN.html: data
$RTP3338: directory
$RWZXS4P: directory
desktop.ini: Windows desktop.ini

This doesn't work. I probably wasn't elevated at the time.

notepad C:\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001\$IWZXS4P

But with an elevated hex editor, we get some idea of what the pointer
to the file looks like. If we were to put back the file
which is in the Recycle bin, this file is consulted as
to the location where the file belongs when restored.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000010 00 00 00 00 43 00 3A 00 . ...C.:.
00000020 5C 00 55 00 73 00 65 00 72 00 73 00 5C 00 70 00 \.U.s.e.r.s.\.p.
00000030 69 00 65 00 74 00 72 00 5C 00 44 00 6F 00 77 00 i.e.t.r.\.D.o.w.
00000040 6E 00 6C 00 6F 00 61 00 64 00 73 00 5C 00 70 00 n.l.o.a.d.s.\.p.
00000050 69 00 65 00 74 00 65 00 72 00 2D 00 66 00 6F 00 i.e.t.e.r.-.f.o.
00000060 6C 00 64 00 65 00 72 00 00 00 l.d.e.r...

OK, so what we've got, is a suspicious date stamp, and two files

$IWZXS4P <=== encoding file with path info (including pieter-folder name) 106 bytes
$RWZXS4P <=== the lost folder

Documentation example, here:

https://content-calpoly-edu.s3.amazonaws.com/cci/1/documents/ccic_forensics_manual/CCIC%20Chapter%207%20-%20Recycle%20Bin.pdf

You'll notice the junk in my Recycle bin for the example,
only the recently lost item has a pair of references. The
broken attempts at deletion, left half the materials behind
for the other items.

*******

So all we can hope, as a starting position, is Pieter lost
the folder on the desktop. Using Notepad on the NFI output
file, should reveal exactly where it went.

File 8641
\Users\pieter\Desktop\pieter-folder <=== it was dropped onto the desktop
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident)

If there is some monkey-business in the Recycle Bin, first we
look in there with File Explorer and hope it is visible like
it should be!

Paul

In article <k5eqmfF6avpU1@mid.individual.net>, Fokke Nauta wrote...
>
> On 19/02/2023 15:30, Graham J wrote:
> > Fokke Nauta wrote:
> >> Hi all,
> >>
> >> A very strange problem here. An old friend of mine (80+) is using
> >> Windows 10 home on his laptop. In the Document folder he created a new
> >> folder called PIETER with many documents in it. Lately he opened that
> >> folder again, to create a new folder in it. I guess by the cause of
> >> his shaking hands, something went wrong and the folder PIETER has
> >> disappeared. Instead of that there was a shorcut named PIETER but it
> >> can't be opened. Neither by double clicking, nor by Open or Properties
> >> - Open file location. Simply no response.
> >> Is there any chance we can open it or find the folder called PIETER?
> >> By searching in the file explorer there was no result.
> >
> > What I've seen before when people with shaky hands use a computer, is
> > that they inadvertently drag a folder inside another.
>
> That's what I thought as well. In the file explorer I looked in the
> Documents folder and searched for PIETER. No such folder found. So I
> assumed it's gone. Hence the shortcut with the same name.
>
> > I'm worried that the shortcut elicits no response - normally it would
> > say "can't find target" or words to that effect.
>
> Yes, indeed. But no response at all.
>
> > Have you seen the problem for yourself, or is it what Pieter tells you
> > over the phone?
>
> I use Teamviewer to look into his laptop. I have been looking and
> searching myself remotely.
>
> > I suggest you investigate personally - go there, or get him to bring the
> > laptop to you.
> >
> > Searching from the root of the filesystem may help (typically C:\) but
> > you will need to make hidden and system files visible (temporarily)
> > since the folder may have been moved inside a hidden folder.
>
> I did!
>
> > If it's been deleted, it should be possible to recover it from the
> > "Deleted items" folder.
>
> It's not in there.
>
> > There are only two classes of people in the world: those who have lost
> > files from a computer, and those who will.
> >
> > So where is the backup?
> >
>
> On a stick. But he will loose the recent changed documents.
>
> Thanks!
>
> Fokke

Have you examined the shortcut? Right-click and pick "Properties", and you
should see the target of the shortcut. Might give you a clue. One of the
options for moving a file (when you right-click and drag) is to save a shortcut
to the (unmoved) file in the target location.

--

Phil, London

On 19/02/2023 17:40, Philip Herlihy wrote:
> In article <k5eqmfF6avpU1@mid.individual.net>, Fokke Nauta wrote...
>>
>> On 19/02/2023 15:30, Graham J wrote:
>>> Fokke Nauta wrote:
>>>> Hi all,
>>>>
>>>> A very strange problem here. An old friend of mine (80+) is using
>>>> Windows 10 home on his laptop. In the Document folder he created a new
>>>> folder called PIETER with many documents in it. Lately he opened that
>>>> folder again, to create a new folder in it. I guess by the cause of
>>>> his shaking hands, something went wrong and the folder PIETER has
>>>> disappeared. Instead of that there was a shorcut named PIETER but it
>>>> can't be opened. Neither by double clicking, nor by Open or Properties
>>>> - Open file location. Simply no response.
>>>> Is there any chance we can open it or find the folder called PIETER?
>>>> By searching in the file explorer there was no result.
>>>
>>> What I've seen before when people with shaky hands use a computer, is
>>> that they inadvertently drag a folder inside another.
>>
>> That's what I thought as well. In the file explorer I looked in the
>> Documents folder and searched for PIETER. No such folder found. So I
>> assumed it's gone. Hence the shortcut with the same name.
>>
>>> I'm worried that the shortcut elicits no response - normally it would
>>> say "can't find target" or words to that effect.
>>
>> Yes, indeed. But no response at all.
>>
>>> Have you seen the problem for yourself, or is it what Pieter tells you
>>> over the phone?
>>
>> I use Teamviewer to look into his laptop. I have been looking and
>> searching myself remotely.
>>
>>> I suggest you investigate personally - go there, or get him to bring the
>>> laptop to you.
>>>
>>> Searching from the root of the filesystem may help (typically C:\) but
>>> you will need to make hidden and system files visible (temporarily)
>>> since the folder may have been moved inside a hidden folder.
>>
>> I did!
>>
>>> If it's been deleted, it should be possible to recover it from the
>>> "Deleted items" folder.
>>
>> It's not in there.
>>
>>> There are only two classes of people in the world: those who have lost
>>> files from a computer, and those who will.
>>>
>>> So where is the backup?
>>>
>>
>> On a stick. But he will loose the recent changed documents.
>>
>> Thanks!
>>
>> Fokke
>
> Have you examined the shortcut? Right-click and pick "Properties", and you
> should see the target of the shortcut.

It was empty. Also Open file location did not do anything.

> Might give you a clue. One of the
> options for moving a file (when you right-click and drag) is to save a shortcut
> to the (unmoved) file in the target location.

Yes, I know.

Thanks.

Fokke
>

On 19/02/2023 16:31, Paul wrote:
> On 2/19/2023 8:22 AM, Fokke Nauta wrote:
>> Hi all,
>>
>> A very strange problem here. An old friend of mine (80+) is using
>> Windows 10 home on his laptop. In the Document folder he created a new
>> folder called PIETER with many documents in it. Lately he opened that
>> folder again, to create a new folder in it. I guess by the cause of
>> his shaking hands, something went wrong and the folder PIETER has
>> disappeared. Instead of that there was a shorcut named PIETER but it
>> can't be opened. Neither by double clicking, nor by Open or Properties
>> - Open file location. Simply no response.
>> Is there any chance we can open it or find the folder called PIETER?
>> By searching in the file explorer there was no result.
>>
>> Many thanks in advance.
>>
>> Fokke Nauta
>
> nfi.exe is in here (3,772,278 byte ZIP).
>
> In the nfi folder. nfi.exe is 21,744 bytes. You would
> have to copy nfi.exe out of the ZIP file, for later usage.
>
>
> https://web.archive.org/web/20070104083656if_/http://download.microsoft.com:80/download/win2000srv/utility/3.0/nt45/en-us/oem3sr2.zip
>
> In an Administrator Command Prompt window, run something like:
>
>    cd /d C:\users\pieter\Downloads\       # presumed location of
> unpacked nfi.exe
>
>    nfi.exe  c: > nfi_c_out.txt            # we will assume
> pieter-folder has moved somewhere
>                                           # on the same partition, but
> we don't know where
>
>    notepad nfi_c_out.txt                  # search for the
> pieter-folder in here
>
> Now, let us look in the file for the item.
>
> File 8641
> \Users\pieter\Downloads\pieter-folder  <=== where I originally created it
>     $STANDARD_INFORMATION (resident)
>     $FILE_NAME (resident)
>     $FILE_NAME (resident)
>     $INDEX_ROOT $I30 (resident)      <=== this is what makes it a
> directory
>                                           Mere data files don't have
> that line
>
> If I accidentally drag and drop it to the Desktop, the
> file entry looks like this. The item may be invisible
> on the desktop (sometimes the coordinates of an icon, are off-screen).
> But this tells us, we have not lost it.
>
> File 8641
> \Users\pieter\Desktop\pieter-folder   <=== it was dropped onto the desktop
>     $STANDARD_INFORMATION (resident)
>     $FILE_NAME (resident)
>     $FILE_NAME (resident)
>     $INDEX_ROOT $I30 (resident)
>
> OK, now I will throw the file in the trash and look for it.
> This requires re-running the nfi command, after move to trash.
> Now, the file cannot be found, because it is "encoded". Notice
> though, that the file number has not changed (this does not
> help Pieter though, in his quest -- it just helps me figure out
> where it went). The filenum has not changed, but the path is
> tricksy.
>
> File 8641
> \$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001\$RWZXS4P
>     $STANDARD_INFORMATION (resident)
>     $FILE_NAME (resident)
>     $INDEX_ROOT $I30 (resident)
>
> The 1111111111-2222222222-3333333333 is my account number, the
> 1001 is the short number for it (user accounts start at 1000,
> the administrator account if enabled is 500).
>
> From the command prompt in that administrative window,
> you can see that the folder has more structure than
> you can see in File Explorer. There is irrelevant junk
> in there, as long as the two items I'm looking for.
>
> cd /d C:\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001\
>
> dir
>
>  Volume in drive C is W11HOME
>  Volume Serial Number is FA6E-E6DA
>
>  Directory of
> C:\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001
>
> 11/17/2022  02:21 PM                90 $IB1E2YM
> 05/24/2022  08:10 AM               162 $IORC0QG
> 02/16/2023  12:10 AM               116 $IWYYHPC
> 02/19/2023  09:50 AM               106 $IWZXS4P       <=== hmmm. what is
> in here ?
> 05/24/2022  08:10 AM               160 $IZOMNAN.html
> 06/25/2022  06:43 PM    <DIR>          $RTP3338
> 02/19/2023  09:40 AM    <DIR>          $RWZXS4P       <=== this is
> pieter-folder
>                5 File(s)            634 bytes
>                2 Dir(s)  60,838,133,760 bytes free
>
> $IB1E2YM:      data
> $IORC0QG:      data
> $IWYYHPC:      data
> $IWZXS4P:      data      <=== no hint yet, as to what this is
> $IZOMNAN.html: data
> $RTP3338:      directory
> $RWZXS4P:      directory
> desktop.ini:   Windows desktop.ini
>
> This doesn't work. I probably wasn't elevated at the time.
>
> notepad
> C:\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001\$IWZXS4P
>
> But with an elevated hex editor, we get some idea of what the pointer
> to the file looks like. If we were to put back the file
> which is in the Recycle bin, this file is consulted as
> to the location where the file belongs when restored.
>
> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
>
> 00000000  02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
> 00000010  00                         00 00 00 43 00 3A 00  .        ...C.:.
> 00000020  5C 00 55 00 73 00 65 00 72 00 73 00 5C 00 70 00  \.U.s.e.r.s.\.p.
> 00000030  69 00 65 00 74 00 72 00 5C 00 44 00 6F 00 77 00  i.e.t.r.\.D.o.w.
> 00000040  6E 00 6C 00 6F 00 61 00 64 00 73 00 5C 00 70 00  n.l.o.a.d.s.\.p.
> 00000050  69 00 65 00 74 00 65 00 72 00 2D 00 66 00 6F 00  i.e.t.e.r.-.f.o.
> 00000060  6C 00 64 00 65 00 72 00 00 00                    l.d.e.r...
>
> OK, so what we've got, is a suspicious date stamp, and two files
>
> $IWZXS4P   <=== encoding file with path info (including pieter-folder
> name)  106 bytes
> $RWZXS4P   <=== the lost folder
>
> Documentation example, here:
>
>
> https://content-calpoly-edu.s3.amazonaws.com/cci/1/documents/ccic_forensics_manual/CCIC%20Chapter%207%20-%20Recycle%20Bin.pdf
>
> You'll notice the junk in my Recycle bin for the example,
> only the recently lost item has a pair of references. The
> broken attempts at deletion, left half the materials behind
> for the other items.
>
> *******
>
> So all we can hope, as a starting position, is Pieter lost
> the folder on the desktop. Using Notepad on the NFI output
> file, should reveal exactly where it went.
>
> File 8641
> \Users\pieter\Desktop\pieter-folder   <=== it was dropped onto the desktop
>     $STANDARD_INFORMATION (resident)
>     $FILE_NAME (resident)
>     $FILE_NAME (resident)
>     $INDEX_ROOT $I30 (resident)
>
> If there is some monkey-business in the Recycle Bin, first we
> look in there with File Explorer and hope it is visible like
> it should be!
>
>   Paul
>

Thanks, Paul.

That's a whole lot.
I will get along with nfi.exe and will let you know how it works.

Fokke

On 2/19/2023 8:22 AM, Fokke Nauta wrote:
> Hi all,
>
> A very strange problem here. An old friend of mine (80+) is using
> Windows 10 home on his laptop. In the Document folder he created a new
> folder called PIETER with many documents in it. Lately he opened that
> folder again, to create a new folder in it. I guess by the cause of his
> shaking hands, something went wrong and the folder PIETER has
> disappeared. Instead of that there was a shorcut named PIETER but it
> can't be opened. Neither by double clicking, nor by Open or Properties -
> Open file location. Simply no response.
> Is there any chance we can open it or find the folder called PIETER? By
> searching in the file explorer there was no result.
>
> Many thanks in advance.
>
> Fokke Nauta
use a search app like Everything and search a file name he remembers as
being in PIETER.

On 19/02/2023 20:13, Zaidy036 wrote:
> On 2/19/2023 8:22 AM, Fokke Nauta wrote:
>> Hi all,
>>
>> A very strange problem here. An old friend of mine (80+) is using
>> Windows 10 home on his laptop. In the Document folder he created a new
>> folder called PIETER with many documents in it. Lately he opened that
>> folder again, to create a new folder in it. I guess by the cause of
>> his shaking hands, something went wrong and the folder PIETER has
>> disappeared. Instead of that there was a shorcut named PIETER but it
>> can't be opened. Neither by double clicking, nor by Open or Properties
>> - Open file location. Simply no response.
>> Is there any chance we can open it or find the folder called PIETER?
>> By searching in the file explorer there was no result.
>>
>> Many thanks in advance.
>>
>> Fokke Nauta
> use a search app like Everything and search a file name he remembers as
> being in PIETER.

Thanks. I downloaded it and will give it a try.

Fokke

On 2/19/2023 9:30 AM, Graham J wrote:
> Fokke Nauta wrote:
>> Hi all,
>>
>> A very strange problem here. An old friend of mine (80+) is using
>> Windows 10 home on his laptop. In the Document folder he created a new
>> folder called PIETER with many documents in it. Lately he opened that
>> folder again, to create a new folder in it. I guess by the cause of
>> his shaking hands, something went wrong and the folder PIETER has
>> disappeared. Instead of that there was a shorcut named PIETER but it
>> can't be opened. Neither by double clicking, nor by Open or Properties
>> - Open file location. Simply no response.
>> Is there any chance we can open it or find the folder called PIETER?
>> By searching in the file explorer there was no result.
>
> What I've seen before when people with shaky hands use a computer, is
> that they inadvertently drag a folder inside another.
>
> I'm worried that the shortcut elicits no response - normally it would
> say "can't find target" or words to that effect.
>
> Have you seen the problem for yourself, or is it what Pieter tells you
> over the phone?
>
> I suggest you investigate personally - go there, or get him to bring the
> laptop to you.
>
> Searching from the root of the filesystem may help (typically C:\) but
> you will need to make hidden and system files visible (temporarily)
> since the folder may have been moved inside a hidden folder.
>
> If it's been deleted, it should be possible to recover it from the
> "Deleted items" folder.
>
> There are only two classes of people in the world: those who have lost
> files from a computer, and those who will.
>
> So where is the backup?
>
>
What someone attributed to "shaky hands" I call mouse droppings. I
have accidentally moved many files in this way..

Why it is a good idea to search for "Peter" it is possible that it got
moved to the main area on the disk, so search for it from C:/ or the
partial name of that file. ie "PET"

Also ask what was the name of the file he was going to open and search
the C:/ for that file, or partial name of the file.

As suggested check the Properties, of the new short cut, it is possible
that the name of the directory is corrupted.

On 19/02/2023 16:31, Paul wrote:
> On 2/19/2023 8:22 AM, Fokke Nauta wrote:
>> Hi all,
>>
>> A very strange problem here. An old friend of mine (80+) is using
>> Windows 10 home on his laptop. In the Document folder he created a new
>> folder called PIETER with many documents in it. Lately he opened that
>> folder again, to create a new folder in it. I guess by the cause of
>> his shaking hands, something went wrong and the folder PIETER has
>> disappeared. Instead of that there was a shorcut named PIETER but it
>> can't be opened. Neither by double clicking, nor by Open or Properties
>> - Open file location. Simply no response.
>> Is there any chance we can open it or find the folder called PIETER?
>> By searching in the file explorer there was no result.
>>
>> Many thanks in advance.
>>
>> Fokke Nauta
>
> nfi.exe is in here (3,772,278 byte ZIP).
>
> In the nfi folder. nfi.exe is 21,744 bytes. You would
> have to copy nfi.exe out of the ZIP file, for later usage.
>
>
> https://web.archive.org/web/20070104083656if_/http://download.microsoft.com:80/download/win2000srv/utility/3.0/nt45/en-us/oem3sr2.zip
>
> In an Administrator Command Prompt window, run something like:
>
>    cd /d C:\users\pieter\Downloads\       # presumed location of
> unpacked nfi.exe
>
>    nfi.exe  c: > nfi_c_out.txt            # we will assume
> pieter-folder has moved somewhere
>                                           # on the same partition, but
> we don't know where
>
>    notepad nfi_c_out.txt                  # search for the
> pieter-folder in here
>
> Now, let us look in the file for the item.
>
> File 8641
> \Users\pieter\Downloads\pieter-folder  <=== where I originally created it
>     $STANDARD_INFORMATION (resident)
>     $FILE_NAME (resident)
>     $FILE_NAME (resident)
>     $INDEX_ROOT $I30 (resident)      <=== this is what makes it a
> directory
>                                           Mere data files don't have
> that line
>
> If I accidentally drag and drop it to the Desktop, the
> file entry looks like this. The item may be invisible
> on the desktop (sometimes the coordinates of an icon, are off-screen).
> But this tells us, we have not lost it.
>
> File 8641
> \Users\pieter\Desktop\pieter-folder   <=== it was dropped onto the desktop
>     $STANDARD_INFORMATION (resident)
>     $FILE_NAME (resident)
>     $FILE_NAME (resident)
>     $INDEX_ROOT $I30 (resident)
>
> OK, now I will throw the file in the trash and look for it.
> This requires re-running the nfi command, after move to trash.
> Now, the file cannot be found, because it is "encoded". Notice
> though, that the file number has not changed (this does not
> help Pieter though, in his quest -- it just helps me figure out
> where it went). The filenum has not changed, but the path is
> tricksy.
>
> File 8641
> \$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001\$RWZXS4P
>     $STANDARD_INFORMATION (resident)
>     $FILE_NAME (resident)
>     $INDEX_ROOT $I30 (resident)
>
> The 1111111111-2222222222-3333333333 is my account number, the
> 1001 is the short number for it (user accounts start at 1000,
> the administrator account if enabled is 500).
>
> From the command prompt in that administrative window,
> you can see that the folder has more structure than
> you can see in File Explorer. There is irrelevant junk
> in there, as long as the two items I'm looking for.
>
> cd /d C:\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001\
>
> dir
>
>  Volume in drive C is W11HOME
>  Volume Serial Number is FA6E-E6DA
>
>  Directory of
> C:\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001
>
> 11/17/2022  02:21 PM                90 $IB1E2YM
> 05/24/2022  08:10 AM               162 $IORC0QG
> 02/16/2023  12:10 AM               116 $IWYYHPC
> 02/19/2023  09:50 AM               106 $IWZXS4P       <=== hmmm. what is
> in here ?
> 05/24/2022  08:10 AM               160 $IZOMNAN.html
> 06/25/2022  06:43 PM    <DIR>          $RTP3338
> 02/19/2023  09:40 AM    <DIR>          $RWZXS4P       <=== this is
> pieter-folder
>                5 File(s)            634 bytes
>                2 Dir(s)  60,838,133,760 bytes free
>
> $IB1E2YM:      data
> $IORC0QG:      data
> $IWYYHPC:      data
> $IWZXS4P:      data      <=== no hint yet, as to what this is
> $IZOMNAN.html: data
> $RTP3338:      directory
> $RWZXS4P:      directory
> desktop.ini:   Windows desktop.ini
>
> This doesn't work. I probably wasn't elevated at the time.
>
> notepad
> C:\$Recycle.Bin\S-1-5-21-1111111111-2222222222-3333333333-1001\$IWZXS4P
>
> But with an elevated hex editor, we get some idea of what the pointer
> to the file looks like. If we were to put back the file
> which is in the Recycle bin, this file is consulted as
> to the location where the file belongs when restored.
>
> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
>
> 00000000  02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
> 00000010  00                         00 00 00 43 00 3A 00  .        ...C.:.
> 00000020  5C 00 55 00 73 00 65 00 72 00 73 00 5C 00 70 00  \.U.s.e.r.s.\.p.
> 00000030  69 00 65 00 74 00 72 00 5C 00 44 00 6F 00 77 00  i.e.t.r.\.D.o.w.
> 00000040  6E 00 6C 00 6F 00 61 00 64 00 73 00 5C 00 70 00  n.l.o.a.d.s.\.p.
> 00000050  69 00 65 00 74 00 65 00 72 00 2D 00 66 00 6F 00  i.e.t.e.r.-.f.o.
> 00000060  6C 00 64 00 65 00 72 00 00 00                    l.d.e.r...
>
> OK, so what we've got, is a suspicious date stamp, and two files
>
> $IWZXS4P   <=== encoding file with path info (including pieter-folder
> name)  106 bytes
> $RWZXS4P   <=== the lost folder
>
> Documentation example, here:
>
>
> https://content-calpoly-edu.s3.amazonaws.com/cci/1/documents/ccic_forensics_manual/CCIC%20Chapter%207%20-%20Recycle%20Bin.pdf
>
> You'll notice the junk in my Recycle bin for the example,
> only the recently lost item has a pair of references. The
> broken attempts at deletion, left half the materials behind
> for the other items.
>
> *******
>
> So all we can hope, as a starting position, is Pieter lost
> the folder on the desktop. Using Notepad on the NFI output
> file, should reveal exactly where it went.
>
> File 8641
> \Users\pieter\Desktop\pieter-folder   <=== it was dropped onto the desktop
>     $STANDARD_INFORMATION (resident)
>     $FILE_NAME (resident)
>     $FILE_NAME (resident)
>     $INDEX_ROOT $I30 (resident)
>
> If there is some monkey-business in the Recycle Bin, first we
> look in there with File Explorer and hope it is visible like
> it should be!
>
>   Paul
>

Hi Paul,

Interesting application, nfi.exe.
I ran it on my own pc and saw how it works. Tomorrow I will run it by
Teamviewer on his laptop and see what shows up.

Fokke

On 19/02/2023 20:57, knuttle wrote:
> On 2/19/2023 9:30 AM, Graham J wrote:
>> Fokke Nauta wrote:
>>> Hi all,
>>>
>>> A very strange problem here. An old friend of mine (80+) is using
>>> Windows 10 home on his laptop. In the Document folder he created a
>>> new folder called PIETER with many documents in it. Lately he opened
>>> that folder again, to create a new folder in it. I guess by the cause
>>> of his shaking hands, something went wrong and the folder PIETER has
>>> disappeared. Instead of that there was a shorcut named PIETER but it
>>> can't be opened. Neither by double clicking, nor by Open or
>>> Properties - Open file location. Simply no response.
>>> Is there any chance we can open it or find the folder called PIETER?
>>> By searching in the file explorer there was no result.
>>
>> What I've seen before when people with shaky hands use a computer, is
>> that they inadvertently drag a folder inside another.
>>
>> I'm worried that the shortcut elicits no response - normally it would
>> say "can't find target" or words to that effect.
>>
>> Have you seen the problem for yourself, or is it what Pieter tells you
>> over the phone?
>>
>> I suggest you investigate personally - go there, or get him to bring
>> the laptop to you.
>>
>> Searching from the root of the filesystem may help (typically C:\) but
>> you will need to make hidden and system files visible (temporarily)
>> since the folder may have been moved inside a hidden folder.
>>
>> If it's been deleted, it should be possible to recover it from the
>> "Deleted items" folder.
>>
>> There are only two classes of people in the world: those who have lost
>> files from a computer, and those who will.
>>
>> So where is the backup?
>>
>>
> What someone attributed to "shaky hands" I call mouse droppings.   I
> have accidentally moved many files in this way..
>
>
> Why it is a good idea to search for "Peter" it is possible that it got
> moved to the main area on the disk, so search for it from C:/  or the
> partial name of that file.  ie "PET"

I looked at the C: partition and searched for PIETER. No result.

> Also ask what was the name of the file he was going to open and search
> the C:/  for that file, or partial name of the file.

I will ask him to search for that document he was looking for.

> As suggested check the Properties, of the new short cut, it is possible
> that the name of the directory is corrupted.
>

There was no directory! It was empty.

Fokke

On 2/19/2023 2:13 PM, Zaidy036 wrote:
> On 2/19/2023 8:22 AM, Fokke Nauta wrote:
>> Hi all,
>>
>> A very strange problem here. An old friend of mine (80+) is using Windows 10 home on his laptop. In the Document folder he created a new folder called PIETER with many documents in it. Lately he opened that folder again, to create a new folder in it. I guess by the cause of his shaking hands, something went wrong and the folder PIETER has disappeared. Instead of that there was a shorcut named PIETER but it can't be opened. Neither by double clicking, nor by Open or Properties - Open file location. Simply no response.
>> Is there any chance we can open it or find the folder called PIETER? By searching in the file explorer there was no result.
>>
>> Many thanks in advance.
>>
>> Fokke Nauta
> use a search app like Everything and search a file name he remembers as being in PIETER.

Everything.exe from voidtools, lists the things it can access.

You don't have to install it fully, in the search sense. It
can be run like this.

everything.exe -create-file-list D:\temp\every_c.txt C:\

What that does, is list all the files and folders. The syntax
varies between versions, and you have to be patient while it
runs (because Windows Defender may be interfering with the run).

The command prompt runs immediately, but you may have to watch
Task Manager to tell what it is doing.

Everything.exe differs from NFI.exe, in that it lists hardlinked
files by both their filenames. NFI.exe only lists one of the two
filenames on a hardlinked file. The difference, around 30,000 entries,
is equal to all the files and folders in C:\Windows\WinSxS folder.

Everything.exe then, makes a list humans can use.

Paul

On 2/19/2023 6:01 PM, Paul wrote:
> On 2/19/2023 2:13 PM, Zaidy036 wrote:
>> On 2/19/2023 8:22 AM, Fokke Nauta wrote:
>>> Hi all,
>>>
>>> A very strange problem here. An old friend of mine (80+) is using Windows 10 home on his laptop. In the Document folder he created a new folder called PIETER with many documents in it. Lately he opened that folder again, to create a new folder in it. I guess by the cause of his shaking hands, something went wrong and the folder PIETER has disappeared. Instead of that there was a shorcut named PIETER but it can't be opened. Neither by double clicking, nor by Open or Properties - Open file location. Simply no response.
>>> Is there any chance we can open it or find the folder called PIETER? By searching in the file explorer there was no result.
>>>
>>> Many thanks in advance.
>>>
>>> Fokke Nauta
>> use a search app like Everything and search a file name he remembers as being in PIETER.
>
> Everything.exe from voidtools, lists the things it can access.
>
> You don't have to install it fully, in the search sense. It
> can be run like this.
>
>   everything.exe -create-file-list D:\temp\every_c.txt C:\
>
> What that does, is list all the files and folders. The syntax
> varies between versions, and you have to be patient while it
> runs (because Windows Defender may be interfering with the run).
>
> The command prompt runs immediately, but you may have to watch
> Task Manager to tell what it is doing.
>
> Everything.exe differs from NFI.exe, in that it lists hardlinked
> files by both their filenames. NFI.exe only lists one of the two
> filenames on a hardlinked file. The difference, around 30,000 entries,
> is equal to all the files and folders in C:\Windows\WinSxS folder.
>
> Everything.exe then, makes a list humans can use.
>
>     Paul
>

The timestamps in the every_c.txt are not readable directly.

"C:\Users\username\Downloads\Everything.ini",20318,133213174822850647,133213174822850647,32

I have a little utility, if they need conversion.

C:\> filetime.exe 133213174822850647
1D944AD 3CB7D057
02/19/2023 16:58:02.285 <=== proof that a recently created file is roughly correct

********************************* filetime.c *********************************
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <Windows.h>
#include <WinBase.h>

int main(int argc, char *argv[])
{ FILETIME timein;
SYSTEMTIME stUTC, stLocal;
DWORD dwRet;

long long int arrgh;
int conv1;

/* typedef struct _FILETIME { = 131679807063691748;
DWORD dwLowDateTime; 1D3D216 0x3C1F91E4
DWORD dwHighDateTime;

timein.dwLowDateTime = 0x3C1F91E4;
timein.dwHighDateTime = 0x01D3D216; */

if (argc != 2) goto later;
if ( (conv1 = sscanf(argv[1], "%I64d", &arrgh)) == 0) goto later;
timein.dwLowDateTime = (unsigned int) 0xFFFFFFFF & arrgh;
timein.dwHighDateTime = (unsigned int) 0xFFFFFFFF & (arrgh >> 32);

printf("%X %X\n", timein.dwHighDateTime, timein.dwLowDateTime);

FileTimeToSystemTime(&timein, &stUTC);

SystemTimeToTzSpecificLocalTime(NULL, &stUTC, &stLocal);

printf("%02d/%02d/%d %02d:%02d:%02d.%03d\n",
stLocal.wMonth, stLocal.wDay, stLocal.wYear,
stLocal.wHour, stLocal.wMinute,
stLocal.wSecond, stLocal.wMilliseconds);

later: return 0;
} ********************************* end filetime.c *********************************

Paul

On 20/02/2023 00:01, Paul wrote:
> On 2/19/2023 2:13 PM, Zaidy036 wrote:
>> On 2/19/2023 8:22 AM, Fokke Nauta wrote:
>>> Hi all,
>>>
>>> A very strange problem here. An old friend of mine (80+) is using
>>> Windows 10 home on his laptop. In the Document folder he created a
>>> new folder called PIETER with many documents in it. Lately he opened
>>> that folder again, to create a new folder in it. I guess by the cause
>>> of his shaking hands, something went wrong and the folder PIETER has
>>> disappeared. Instead of that there was a shorcut named PIETER but it
>>> can't be opened. Neither by double clicking, nor by Open or
>>> Properties - Open file location. Simply no response.
>>> Is there any chance we can open it or find the folder called PIETER?
>>> By searching in the file explorer there was no result.
>>>
>>> Many thanks in advance.
>>>
>>> Fokke Nauta
>> use a search app like Everything and search a file name he remembers
>> as being in PIETER.
>
> Everything.exe from voidtools, lists the things it can access.
>
> You don't have to install it fully, in the search sense. It
> can be run like this.
>
>   everything.exe -create-file-list D:\temp\every_c.txt C:\
>
> What that does, is list all the files and folders. The syntax
> varies between versions, and you have to be patient while it
> runs (because Windows Defender may be interfering with the run).
>
> The command prompt runs immediately, but you may have to watch
> Task Manager to tell what it is doing.
>
> Everything.exe differs from NFI.exe, in that it lists hardlinked
> files by both their filenames. NFI.exe only lists one of the two
> filenames on a hardlinked file. The difference, around 30,000 entries,
> is equal to all the files and folders in C:\Windows\WinSxS folder.
>
> Everything.exe then, makes a list humans can use.
>
>     Paul
>

Thanks, Paul.
Good to know.

Fokke

On 19/02/2023 14:22, Fokke Nauta wrote:
> Hi all,
>
> A very strange problem here. An old friend of mine (80+) is using
> Windows 10 home on his laptop. In the Document folder he created a new
> folder called PIETER with many documents in it. Lately he opened that
> folder again, to create a new folder in it. I guess by the cause of his
> shaking hands, something went wrong and the folder PIETER has
> disappeared. Instead of that there was a shorcut named PIETER but it
> can't be opened. Neither by double clicking, nor by Open or Properties -
> Open file location. Simply no response.
> Is there any chance we can open it or find the folder called PIETER? By
> searching in the file explorer there was no result.
>
> Many thanks in advance.
>
> Fokke Nauta

Hi all,

The problem has been solved. My friend could remember a file name of a
document which was in the folder PIETER. He searched for it and found
the document. It was still in the folder PIETER, which was now found in
a sub folder under the folder Pictures. Haven't got a clue as to how he
managed to do so. But now I'm sure that an old man with shaky hands and
Windows don't fit.

Thank you all for your help and responses. I learned someting new again.

Fokke

On 20/02/2023 00:35, Paul wrote:
> On 2/19/2023 6:01 PM, Paul wrote:
>> On 2/19/2023 2:13 PM, Zaidy036 wrote:
>>> On 2/19/2023 8:22 AM, Fokke Nauta wrote:
>>>> Hi all,
>>>>
>>>> A very strange problem here. An old friend of mine (80+) is using
>>>> Windows 10 home on his laptop. In the Document folder he created a
>>>> new folder called PIETER with many documents in it. Lately he opened
>>>> that folder again, to create a new folder in it. I guess by the
>>>> cause of his shaking hands, something went wrong and the folder
>>>> PIETER has disappeared. Instead of that there was a shorcut named
>>>> PIETER but it can't be opened. Neither by double clicking, nor by
>>>> Open or Properties - Open file location. Simply no response.
>>>> Is there any chance we can open it or find the folder called PIETER?
>>>> By searching in the file explorer there was no result.
>>>>
>>>> Many thanks in advance.
>>>>
>>>> Fokke Nauta
>>> use a search app like Everything and search a file name he remembers
>>> as being in PIETER.
>>
>> Everything.exe from voidtools, lists the things it can access.
>>
>> You don't have to install it fully, in the search sense. It
>> can be run like this.
>>
>>    everything.exe -create-file-list D:\temp\every_c.txt C:\
>>
>> What that does, is list all the files and folders. The syntax
>> varies between versions, and you have to be patient while it
>> runs (because Windows Defender may be interfering with the run).
>>
>> The command prompt runs immediately, but you may have to watch
>> Task Manager to tell what it is doing.
>>
>> Everything.exe differs from NFI.exe, in that it lists hardlinked
>> files by both their filenames. NFI.exe only lists one of the two
>> filenames on a hardlinked file. The difference, around 30,000 entries,
>> is equal to all the files and folders in C:\Windows\WinSxS folder.
>>
>> Everything.exe then, makes a list humans can use.
>>
>>      Paul
>>
>
> The timestamps in the every_c.txt are not readable directly.
>
> "C:\Users\username\Downloads\Everything.ini",20318,133213174822850647,133213174822850647,32
>
> I have a little utility, if they need conversion.
>
> C:\> filetime.exe 133213174822850647
> 1D944AD 3CB7D057
> 02/19/2023  16:58:02.285   <=== proof that a recently created file is
> roughly correct
>
> ********************************* filetime.c
> *********************************
> #include <stdio.h>
> #include <stdlib.h>
> #include <string.h>
>
> #include <Windows.h>
> #include <WinBase.h>
>
> int main(int argc, char *argv[])
> {
>    FILETIME timein;
>    SYSTEMTIME stUTC, stLocal;
>    DWORD dwRet;
>
>    long long int arrgh;
>    int conv1;
>
> /* typedef struct _FILETIME {      = 131679807063691748;
>     DWORD dwLowDateTime;         1D3D216 0x3C1F91E4
>     DWORD dwHighDateTime;
>
>    timein.dwLowDateTime  =  0x3C1F91E4;
>    timein.dwHighDateTime =  0x01D3D216; */
>
>    if (argc != 2) goto later;
>    if ( (conv1 = sscanf(argv[1], "%I64d", &arrgh))  == 0) goto later;
>    timein.dwLowDateTime  = (unsigned int) 0xFFFFFFFF & arrgh;
>    timein.dwHighDateTime = (unsigned int) 0xFFFFFFFF & (arrgh >> 32);
>
>    printf("%X %X\n", timein.dwHighDateTime, timein.dwLowDateTime);
>
>    FileTimeToSystemTime(&timein, &stUTC);
>
>    SystemTimeToTzSpecificLocalTime(NULL, &stUTC, &stLocal);
>
>    printf("%02d/%02d/%d  %02d:%02d:%02d.%03d\n",
>            stLocal.wMonth, stLocal.wDay, stLocal.wYear,
>            stLocal.wHour, stLocal.wMinute,
>            stLocal.wSecond, stLocal.wMilliseconds);
>
> later:   return 0;
> }
> ********************************* end filetime.c
> *********************************
>
>    Paul
>
>
>

Thanks, Paul.

This makes sense.

Fokke

Fokke Nauta wrote:

[snip]

>
> The problem has been solved. My friend could remember a file name of a
> document which was in the folder PIETER. He searched for it and found
> the document. It was still in the folder PIETER, which was now found in
> a sub folder under the folder Pictures. Haven't got a clue as to how he
> managed to do so. But now I'm sure that an old man with shaky hands and
> Windows don't fit.
>
> Thank you all for your help and responses. I learned someting new again.

Worrying that Search did not find PIETER.

Since this is a laptop does the old man use the built-in trackpad, or a
separate mouse?

I find the trackpads think I have tapped when I haven't, so the first
thing I do is to disable tapping. Sometimes it's difficult to find
where to do this - if you can't ask here, quoting the manufacturer and
model number of the laptop.

An ordinary mouse can be as litle as £5 from your local supermarket.
Well worth getting one. You can then configure its sensitivity to only
respond to gross movements. A cork floor tile makes an the ideal mouse-mat.

I know several 80+ age users who have no difficulty with a mouse. Does
your friend have an underlying medical condition which causes the shaky
hands? There may be people who can recommend an alternative to a mouse.

It is of couse possible to drive a Windows computer without using a
mouse - the tab and arrow keys will do everything you need. I learnt to
do this in the early days of PCs before a mouse was a widely available
device. It's often quicker, and certainly more accurate than a mouse.

--
Graham J

On 2/20/2023 6:42 AM, Fokke Nauta wrote:
> On 19/02/2023 14:22, Fokke Nauta wrote:
>> Hi all,
>>
>> A very strange problem here. An old friend of mine (80+) is using
>> Windows 10 home on his laptop. In the Document folder he created a new
>> folder called PIETER with many documents in it. Lately he opened that
>> folder again, to create a new folder in it. I guess by the cause of
>> his shaking hands, something went wrong and the folder PIETER has
>> disappeared. Instead of that there was a shorcut named PIETER but it
>> can't be opened. Neither by double clicking, nor by Open or Properties
>> - Open file location. Simply no response.
>> Is there any chance we can open it or find the folder called PIETER?
>> By searching in the file explorer there was no result.
>>
>> Many thanks in advance.
>>
>> Fokke Nauta
>
> Hi all,
>
> The problem has been solved. My friend could remember a file name of a
> document which was in the folder PIETER. He searched for it and found
> the document. It was still in the folder PIETER, which was now found in
> a sub folder under the folder Pictures. Haven't got a clue as to how he
> managed to do so. But now I'm sure that an old man with shaky hands and
> Windows don't fit.
>
> Thank you all for your help and responses. I learned someting new again.
>
> Fokke
I have done that and I don't have shaky hands, I call it mouse dribble
with I accidentally move a file.

Thank you for taking the time to help your friend.

On 20/02/2023 13:34, knuttle wrote:
> On 2/20/2023 6:42 AM, Fokke Nauta wrote:
>> On 19/02/2023 14:22, Fokke Nauta wrote:
>>> Hi all,
>>>
>>> A very strange problem here. An old friend of mine (80+) is using
>>> Windows 10 home on his laptop. In the Document folder he created a
>>> new folder called PIETER with many documents in it. Lately he opened
>>> that folder again, to create a new folder in it. I guess by the cause
>>> of his shaking hands, something went wrong and the folder PIETER has
>>> disappeared. Instead of that there was a shorcut named PIETER but it
>>> can't be opened. Neither by double clicking, nor by Open or
>>> Properties - Open file location. Simply no response.
>>> Is there any chance we can open it or find the folder called PIETER?
>>> By searching in the file explorer there was no result.
>>>
>>> Many thanks in advance.
>>>
>>> Fokke Nauta
>>
>> Hi all,
>>
>> The problem has been solved. My friend could remember a file name of a
>> document which was in the folder PIETER. He searched for it and found
>> the document. It was still in the folder PIETER, which was now found
>> in a sub folder under the folder Pictures. Haven't got a clue as to
>> how he managed to do so. But now I'm sure that an old man with shaky
>> hands and Windows don't fit.
>>
>> Thank you all for your help and responses. I learned someting new again.
>>
>> Fokke
> I have done that and I don't have shaky hands,  I call it mouse dribble
> with I accidentally move a file.
>
> Thank you for taking the time to help your friend.

Thanks!

Yes, the mouse is sensitive for sudden movements.

But I keep helping him out. Happily I can use Teamviewer.

Fokke

On 20/02/2023 13:02, Graham J wrote:
> Fokke Nauta wrote:
>
> [snip]
>
>>
>> The problem has been solved. My friend could remember a file name of a
>> document which was in the folder PIETER. He searched for it and found
>> the document. It was still in the folder PIETER, which was now found
>> in a sub folder under the folder Pictures. Haven't got a clue as to
>> how he managed to do so. But now I'm sure that an old man with shaky
>> hands and Windows don't fit.
>>
>> Thank you all for your help and responses. I learned someting new again.
>
> Worrying that Search did not find PIETER.

I was surprised we coulnd't find it. But now I have understood why we
coulnd't find it. We searched in the Documents folder, but the folder
PIETER was found in a subfolder in the Pictures folder. Never expected
it to be there.

> Since this is a laptop does the old man use the built-in trackpad, or a
> separate mouse?

He is using the mouse.

> I find the trackpads think I have tapped when I haven't, so the first
> thing I do is to disable tapping.  Sometimes it's difficult to find
> where to do this - if you can't ask here, quoting the manufacturer and
> model number of the laptop.
>
> An ordinary mouse can be as litle as £5 from your local supermarket.
> Well worth getting one.

Well, he has one.

> You can then configure its sensitivity to only
> respond to gross movements.

That's a good idea. I will look for that.

> A cork floor tile makes an the ideal
> mouse-mat.

He has a good mouse mat.

> I know several 80+ age users who have no difficulty with a mouse.  Does
> your friend have an underlying medical condition which causes the shaky
> hands?  There may be people who can recommend an alternative to a mouse.
>
> It is of couse possible to drive a Windows computer without using a
> mouse - the tab and arrow keys will do everything you need.  I learnt to
> do this in the early days of PCs before a mouse was a widely available
> device.  It's often quicker, and certainly more accurate than a mouse.

I can remember that. I had a pc in the eighties, and in those days there
were no mouses,

Fokke

On 2/20/2023 6:42 AM, Fokke Nauta wrote:
> On 19/02/2023 14:22, Fokke Nauta wrote:
>> Hi all,
>>
>> A very strange problem here. An old friend of mine (80+) is using
>> Windows 10 home on his laptop. In the Document folder he created a new
>> folder called PIETER with many documents in it. Lately he opened that
>> folder again, to create a new folder in it. I guess by the cause of
>> his shaking hands, something went wrong and the folder PIETER has
>> disappeared. Instead of that there was a shorcut named PIETER but it
>> can't be opened. Neither by double clicking, nor by Open or Properties
>> - Open file location. Simply no response.
>> Is there any chance we can open it or find the folder called PIETER?
>> By searching in the file explorer there was no result.
>>
>> Many thanks in advance.
>>
>> Fokke Nauta
>
> Hi all,
>
> The problem has been solved. My friend could remember a file name of a
> document which was in the folder PIETER. He searched for it and found
> the document. It was still in the folder PIETER, which was now found in
> a sub folder under the folder Pictures. Haven't got a clue as to how he
> managed to do so. But now I'm sure that an old man with shaky hands and
> Windows don't fit.
>
> Thank you all for your help and responses. I learned someting new again.
>
> Fokke

If using Everything note that under "Search" there is a choice of what
one is looking for: Document, Folder, Executable, etc.

On 2/20/2023 12:54 PM, Fokke Nauta wrote:
> On 20/02/2023 13:02, Graham J wrote:

>> An ordinary mouse can be as litle as £5 from your local supermarket. Well worth getting one.
>
> Well, he has one.

Mouse switches wear out. And when you do a drag with a
worn left-mouse, you can end up dropping the item part
way along your attempted travels.

What happens, is the plastic post that presses on the
switch plunger, wears, and no longer properly depresses
the plunger. Making the switch "noisy".

I have a mouse here, that drops folders all over the place
and it has been retired.

As for the search problem, there are several ways to search,
and you should set up a thorough search for Pieter (so he
can find the lost stuff the next time).

Windows Federated Search (Control Panels : Indexing Options)
Agent Ransack Mythic Software (free version), methodical search
Everything.exe Voidtools (free), scans and keeps lists
nfi.exe Not a search tool, does not list WinSxS materials properly.

Paul

On 21/02/2023 01:45, Paul wrote:
> On 2/20/2023 12:54 PM, Fokke Nauta wrote:
>> On 20/02/2023 13:02, Graham J wrote:
>
>>> An ordinary mouse can be as litle as £5 from your local supermarket.
>>> Well worth getting one.
>>
>> Well, he has one.
>
> Mouse switches wear out. And when you do a drag with a
> worn left-mouse, you can end up dropping the item part
> way along your attempted travels.
>
> What happens, is the plastic post that presses on the
> switch plunger, wears, and no longer properly depresses
> the plunger. Making the switch "noisy".
>
> I have a mouse here, that drops folders all over the place
> and it has been retired.
>
> As for the search problem, there are several ways to search,
> and you should set up a thorough search for Pieter (so he
> can find the lost stuff the next time).
>
>    Windows Federated Search   (Control Panels : Indexing Options)
>    Agent Ransack              Mythic Software (free version),
> methodical search
>    Everything.exe             Voidtools (free), scans and keeps lists
>    nfi.exe                    Not a search tool, does not list WinSxS
> materials properly.
>
>   Paul

Thanks, Paul.

Perhaps a new mouse?

Fokke

On 20/02/2023 21:59, Zaidy036 wrote:
> On 2/20/2023 6:42 AM, Fokke Nauta wrote:
>> On 19/02/2023 14:22, Fokke Nauta wrote:
>>> Hi all,
>>>
>>> A very strange problem here. An old friend of mine (80+) is using
>>> Windows 10 home on his laptop. In the Document folder he created a
>>> new folder called PIETER with many documents in it. Lately he opened
>>> that folder again, to create a new folder in it. I guess by the cause
>>> of his shaking hands, something went wrong and the folder PIETER has
>>> disappeared. Instead of that there was a shorcut named PIETER but it
>>> can't be opened. Neither by double clicking, nor by Open or
>>> Properties - Open file location. Simply no response.
>>> Is there any chance we can open it or find the folder called PIETER?
>>> By searching in the file explorer there was no result.
>>>
>>> Many thanks in advance.
>>>
>>> Fokke Nauta
>>
>> Hi all,
>>
>> The problem has been solved. My friend could remember a file name of a
>> document which was in the folder PIETER. He searched for it and found
>> the document. It was still in the folder PIETER, which was now found
>> in a sub folder under the folder Pictures. Haven't got a clue as to
>> how he managed to do so. But now I'm sure that an old man with shaky
>> hands and Windows don't fit.
>>
>> Thank you all for your help and responses. I learned someting new again.
>>
>> Fokke
>
> If using Everything note that under "Search" there is a choice of what
> one is looking for: Document, Folder, Executable, etc.

Thanks. We already found the map, but I will try out Everything.

Fokke