Question can I restore data from a crashed operating system?

Page 2 - Seeking answers? Join the Tom's Hardware community: where nearly two million members share solutions and discuss the latest tech.
Oct 2, 2024
10
0
10
My custom built desktop PC of 9 years displayed a graphics card error popup window and then a minute later stopped displaying video completely and permanently, so I took it in to a tech repair shop.
I just called the repair shop yesterday to see what progress they were making, and they said that the reason the video output wasn't working was because the operating system had crashed and become corrupted. They also told me that they were in the middle of re-installing windows 10 to the hard drive. I immediately figured that would mean my hard drive data had been completely wiped, but the employee assured me that the hard drive was "empty" when he first looked at it.
I'm highly suspicious of that statement. From what a brief google search tells me, if an OS crashes or becomes corrupted, you can still restore the data. It makes no sense that the hard drive would be "empty", even if some or all of the data inside was corrupted or partially inaccessible. I never gave the employee permission to re-install the OS, wiping my hard drive in the process. He did it without my prior knowledge or approval.
Also, if the OS crashes, does that mean the computer wouldn't still run? Before I took my computer to the shop, I could still hear the computer running. Also, whenever I would press enter too many times after starting up my computer, the lights on my keyboard would go out. I think that correlates with the "time out" period when I enter the incorrect password too many times to login to windows. If the computer was still running albeit without video, would that disqualify an OS failure as the source of my problem?
 

Misgar

Respectable
Mar 2, 2023
1,589
415
2,090
He had a smirk on his face.
Oops! I do hope you didn't have any sensitive data on that drive, e.g. bank account statements, credit card details, photos, videos, utility bills, etc. If so, it might be a good idea to change your bank account login passwords, email passwords, social media passwords, credit/debit card PINs, etc., ON ANOTHER COMPUTER OR SMARTPHONE.

If the guy in the store was grinning and you escaped without paying, they may have trawled your disk drive and copied all the files for later inspection. It's easy to "clone" an entire drive and make a perfect copy of everything, in less than an hour. Identity theft is real.

I'd also suggest running an anti-virus scan immediately with something like Malwarebytes set to "scan for rootkits" (which can take many hours) just in case they've been really sneaky and installed a RAT (Remote Access Trojan) or Ransomware.
https://www.malwarebytes.com/blog/threats/remote-access-trojan-rat

I don't wish to sound paranoid, but it's better to be safe than sorry.

When you've finished the malware scan, try looking for your deleted files with the free version of Recuva, or any other "undelete" program that forum members can think of.
https://www.ccleaner.com/recuva

Sometimes you get lucky and can recover some old data, but remember, each time you install a new program on the drive, or browse the internet, more of your remaining files' sectors will be over-written.