Recover a deleted file from a file server

Django x2 · 8 Jun 2009 at 15:49

So we've just set this environment up and are in the process of signing off backup schedules only to be told that a user has deleted an important file from a Windows 2008 file server whilst they were browsing the folders and files (shares) on their laptop.

Running Recuva says there are no files present in the location to recover, surely they wont be on their laptop??

How am I likely to be able to recover this file?

Thanks

bledd · 8 Jun 2009 at 15:50

run the recovery software on the server itself.. and not on the laptop

Django x2 · 8 Jun 2009 at 15:57

bledd. said:
run the recovery software on the server itself.. and not on the laptop

Yeah, thats what I've done. It says no files were found and I'm not inclined to do a "deep scan" really. What do you think?

NiCkNaMe · 8 Jun 2009 at 16:19

How did the user save the file?

Direct to a network share? Via an offline file setup?

Any other preventative method setup on the server? snapshots, etc ?

Tell the numpty it's generally a good idea not to delete important files

bledd · 8 Jun 2009 at 16:35

if it's file server, it's likely the part of the drive/array has been overwritten already

might just have to say "don't lose" to the user..

Django x2 · 8 Jun 2009 at 16:43

Ok, so I've found it with Recuva's deep scan option and it says the file is unrecoverable.

Is there anything else I can try (other software maybe?), or is this pretty much a lost cause?

CliffyG · 8 Jun 2009 at 16:50

Volume Shadow Copy? Not sure if its on by default in Win2008 though.

Uhtred · 8 Jun 2009 at 17:20

as above - you might have previous versions switched on. RIght click on the folder it was in and click properties>previous versions

Django x2 · 8 Jun 2009 at 18:22

Hmm, Shadow Copies were / are off (on now just in case).

This is epic FAIL

CliffyG · 8 Jun 2009 at 18:49

Sorry to state the obvious but having a production server with no backup solution in place is just asking for trouble.

eXor · 8 Jun 2009 at 18:49

Lucero said:
a user has deleted an important file from a Windows 2008 file server

Was the user the owner of the deleted file? If not, how was (s)he able to delete it? :confused:

Give that user a slap on behalf of OcUK.

Django x2 · 8 Jun 2009 at 22:16

eXor said:
Was the user the owner of the deleted file? If not, how was (s)he able to delete it?

Give that user a slap on behalf of OcUK.

If you have read / write access to a folder share you can delete / rename / move / create any file as much as you like.