Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Someone logged in as a user and removed all of the Google Chrome user's apps, extensions, bookmarks, history, and settings. After which, they closed the browser window and restarted it (overwriting the hidden backup file Chrome makes). These changes have already propagated out to the other machines via Google Sync.

How can I recover this data? Ideally, with as much forensic information as possible (date/times deleted, accessed, etc). I need to recover this data ASAP.

I'm digging around on Google now, but I haven't had made any real headway yet. I'll update this thread with any info I find / attempt.

share|improve this question
    
I went ahead and posted your answer as a Community Wiki answer. This way people can easily see the answer to your question. –  Mike K May 5 at 23:02

1 Answer 1

By following the instructions from http://shaneamurray.blogspot.com/2011/06/restore-lost-extensions-in-google.html, I was able to recover all of the apps, extensions, bookmarks, et al.

Essentially, from a Windows 7 PC, you can go to the following path:

C:\Users{username}\AppData\Local\Google\Chrome\ and right-click on the "User Data" folder. From there, go to Properties, and then the "Previous Versions Tab" and you will be able to restore to an earlier version when the extensions / settings were available.

NOTE: Make sure that the Google Chrome process is not running (including in the System Tray) when restoring the files or you will receive an error (in which case, simply kill the process and hit the 'Try Again' button on the error prompt).

This will restore everything, it appears, other than the Google Gadgets. Unfortunately, I still have to dig through the Linux box where the settings were originally altered and attempt to find some information to determine the date/time the incident occurred. So, the forensic aspect is still a work in progress, but at least the user data has been restored and they learned an incredibly important lesson... Don't leave your PC unlocked.

share|improve this answer

protected by Community Nov 13 at 9:33

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.