Recover a deleted file from a file server

Django x2 · 8 Jun 2009 at 15:49

So we've just set this environment up and are in the process of signing off backup schedules only to be told that a user has deleted an important file from a Windows 2008 file server whilst they were browsing the folders and files (shares) on their laptop.

Running Recuva says there are no files present in the location to recover, surely they wont be on their laptop??

How am I likely to be able to recover this file?

Thanks

Django x2 · 8 Jun 2009 at 15:57

bledd. said:
run the recovery software on the server itself.. and not on the laptop

Yeah, thats what I've done. It says no files were found and I'm not inclined to do a "deep scan" really. What do you think?

Django x2 · 8 Jun 2009 at 16:43

Ok, so I've found it with Recuva's deep scan option and it says the file is unrecoverable.

Is there anything else I can try (other software maybe?), or is this pretty much a lost cause?

Django x2 · 8 Jun 2009 at 18:22

Hmm, Shadow Copies were / are off (on now just in case).

This is epic FAIL

Django x2 · 8 Jun 2009 at 22:16

eXor said:
Was the user the owner of the deleted file? If not, how was (s)he able to delete it?

Give that user a slap on behalf of OcUK.

If you have read / write access to a folder share you can delete / rename / move / create any file as much as you like.