Resolved Computer "spontaneously" runs recovery program? How possible?

How could this have happened?

Friend (not very computer-literate but good with music and photos) comes back from 4-month vacation, turns on his PC (purchased in 2006, and used by him continuously since then), finds strange-looking desktop, is missing his own desktop icons, a bunch of outdated trialware programs trying to update themselves. He calls me for help. After about 1/2 hour of my phone-helping him to remove the junkware, it dawns on me (doh!) that what he has is a "factory-fresh" version of his (eMachines) computer! All his personal stuff is gone! (Obviously no backup.) He swears that neither he nor anyone else touched the machine, much less ran the dreaded factory-recovery program, while he was away (it's a totally secured 1-family house, and the electricity was turned off while he was away).

Everything he had on the hard drive is gone, obviously unrecoverable, from having been overwritten by the recovery operation. There's no CD in the drive, so it wasn't done that way unless by some malicious, computer-crazed burglar, who touched nothing else in the house and left no other trace.

Does anybody have any idea how this could have happened? Are there gremlins at work? Can a machine spontaneously run the recovery program from the manufacturer's recovery partition on the hard drive? Please, any ideas on this would be better than what we have right now -- zero.

Thanks!

Frank D

 

Hmm, send for Sherlock Holmes or Philip Marlowe.

Get him to look at one of the setup log files in \Windows, e.g. double-click on setupapi.log and look at the date of the entries or even the date of the file itself. This will probably confirm that 4 months ago he pressed an F key and returned the machine to factory settings.

If it’s not that, and we hope it's not, has he tried system restore?

 

That F key sounds like a possibility. As soon as he gets back to me (he has car troubles too) I'll run through your suggestions with him.

Frank