Internet Storm Center Article: Recovering LOST files from a hardrive
Backups are always beneficial and as CD media is
inexpensive, I usually make double copies which are tested in another PC.
The Blackworm (CME-24) payload included capabilities
to delete several types of documents and files. Usually, the best “undelete“
tools or services aren't free and these links can provide starting
Internet Storm Center Article: Recovering LOST
files from a hardrive
QUOTE: First if at all possible TURN off the
computer and put the infected drive on another system that is not
infected. If for one reason or another you can not you should cosider
one of the cdrom or floppy based recovery systems and an extra
drive. You should preform recovery to a different filesystem then the one being
recovered from other wise you risk overwriting some files as you recover
others. Be aware some companies offer demos that identifies "lost" files but
doesn't save the files it finds.