Deleted Files Via Dos

GovernmentSecurity.org > System Security > Windows Systems

kingvandal

Nov 9 2004, 08:19 PM

Ok I created a small bat that would delete the temp internet files and such. Made for XP but the user ran it on windows 2000 pro and it removed a bunch of files from her desktop. None are in recycle bin either. Tryed the recovery tools and they all find whats int he recycle bin in c:\. Is there a program that will recover files deleted from within a DOS comand shell? ie: cme.exe

comands used:

CODE

@cd c:\Documents and Settings\%USERNAME%\Local Settings\Temporary Internet Files\content.ie5
@attrib *.* -r -h -s -a
@del *.* /Q /s >> c:\output.txt
@cls@cd c:\Windows\system32\dllcache
@attrib *.* -r -h -s -a
@del *.* /Q /s >> c:\output.txt
@cls
@cd c:\Windows\Temp
@attrib *.* -r -h -s -a
@del *.* /Q /s >> c:\output.txt
@cls
@cd c:\Windows\Offline Web Pages\
@attrib *.* -r -h -s -a
@del *.* /Q /s >> c:\output.txt
@cls
@cd c:\Windows\Downloaded Installations\
@attrib *.* -r -h -s -a
@del *.* /Q /s >> c:\output.txt
@cls
@cd c:\Documents and Settings\%USERNAME%\Local Settings\Temporary Internet Files\
@attrib *.* -r -h -s -a
@del *.* /Q /s >> c:\output.txt
@cls
@cd c:\Documents and Settings\%USERNAME%\Local Settings\Temp
@attrib *.* -r -h -s -a
@del *.* /Q /s >> c:\output.txt
@cls
@cd c:\Documents and Settings\%USERNAME%\Local Settings\History
@attrib *.* -r -h -s -a
@del *.* /Q /s >> c:\output.txt
@cls
@cd c:\Documents and Settings\%USERNAME%\Recent
@attrib *.* -r -h -s -a
@del *.* /Q /s >> c:\output.txt
@cls
@cd c:\Documents and Settings\%USERNAME%\Cookies
@attrib *.* -r -h -s -a
@del *.* /Q /s >> c:\output.txt
@cd c:\
@output.txt
@del output.txt

rich

Serhat

Nov 10 2004, 06:41 PM

Try one of the many recovery tools.. ?
and also.. for deleting temp.. I rather use..
del %temp% /S /Q

your problem is that you just go into dirs and done.. but what if one of the folders don't exist..

like let me put it this way,..
I got the BATCH file in c:\ root...

your batch starts with

@cd c:\Documents and Settings\%USERNAME%\Local Settings\Temporary Internet Files\content.ie5
@attrib *.* -r -h -s -a
@del *.* /Q /s >> c:\output.txt

so if the dir doesn't exist.. it will delete everything in c:\ .. which it can.. there should be something like "if exist" in batch.. I would check that if I were you..

something quick from google

CODE

In DOS, IF EXIST only checks for the existence of files.
Since DOS' devices AUX, COMn, LPTn, NUL and PRN are also treated as files, and they exist in every directory, one way to check for the existence of a directory would be:
IF EXIST C:\TEMP\NUL SET TEMP=C:\TEMP

Serhat

kingvandal

Nov 10 2004, 09:30 PM

Hmm.. Once in awhile when the file was ran it would delete it'self after the batch was done running. But that only seemd to happen when I forgot the @del *.* /Q /s >> c:\output.txt when adding a new path. But that may be why that was doing that. I have tryed all the recovery tools I can find. I will try the IF in there too. Do you think that some how when the batch was looking for the Windows dir it could not find it so it would delete files that where in the same dir as the batch file?

Paul

Nov 11 2004, 08:52 AM

You can also use %errorlevel%, for example:

CODE

c:
cd %temp%
IF %errorlevel%==0 (del *.* /s /q
) ELSE (
echo "Couldnt cd to temp dir"
)

Memo

Nov 11 2004, 10:34 AM

QUOTE(Serhat @ Nov 10 2004, 06:41 PM)

so if the dir doesn't exist.. it will delete everything in c:\ .. which it can.. there should be something like "if exist" in batch.. I would check that if I were you..

what about changing this

CODE

@cd c:\Documents and Settings\%USERNAME%\Local Settings\Temporary Internet Files\content.ie5
@attrib *.* -r -h -s -a
@del *.* /Q /s >> c:\output.txt

to this

CODE

@attrib c:\Documents and Settings\%USERNAME%\Local Settings\Temporary Internet Files\content.ie5\*.* -r -h -s -a
@del c:\Documents and Settings\%USERNAME%\Local Settings\Temporary Internet Files\content.ie5\*.* /Q /s >> c:\output.txt

x^r

Nov 11 2004, 03:50 PM

Hi, you might wanne try it using pushd and popd

CODE

@echo off

pushd %userprofile%\Local Settings\Temporary Internet Files\content.ie5&& Call :DeleteShit&& popd
pushd %windir%\temp&& Call :DeleteShit&& popd
pushd %temp%&& Call :DeleteShit&& popd
:: etc..
output.txt
goto :eof

:DeleteShit
attrib /S /D -r -h -s -a *.*
del /S /Q *.* >> %~dp0output.txt
goto :eof

Not aware of any 'simple' prog to recover deleted files with 'del'

Greetz x^r

cool_one

Nov 11 2004, 08:32 PM

i hate to break it to you
but the best thing you can do do i look for something like undelete. the pulls up disk sectors, if they haven't been written over.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.