deleted files over network (Recover)

[proskater123]

I deleted some essential files on my network (Shared folders) and didn't notice until after the delete, there were files in the folder i deleted that i needed. After I noticed I needed them back i went dumpster diving in my recycling bin but discovered the files were not there. Not on my computer nor the computer the files were stored on. How can i recover the folder?

[gEEEk]

Try some undelete software.

A google search will do to find one.

[VaKo]

When you delete a file from a network drive it just deletes it, no recycle bin. What you need to do is run something like getdataback on the machine that physically stored the file. You might be able to get it back. Otherwise make sure you have shadow copies enabled on your network shares.

[digip]

depends how long ago and how much disk activity you have had since the delete. Most likely, some images and mp3s can be recovered so semi workable formats, text docs, etc, but exe's and such will probably be corrupted beyond use.

best bet is a live disk with recovery software, like an UBCD4WIN type deal or linux distro with forensic media reading capabilities. If you are using the machine right now, chances are your tramping all over the deleted data and just making things worse.

[El Di Pablo]

Was Shadow Copy enabled? If so, you may be able to restore from a previous version.

[digip]

I thought Shadow Copy only took effect if you ran it with NTbackup utility or manually made backup snapshots first. If you didn't make backups, then what? How do you get them back using Shadow Copy? '

Run this from a command prompt.

vssadmin list shadows

If there are none, then no shadow copies exist(from what I understand, but I'm not that familair with Shadow Copy,its functions and how it really works behind the scenes)

[MRGRIM]

Once you've enabled SCS on a share you can set the times it will take snapshots, it does it twice daily. I think ours are setup to take copies around 11AM and then again around 4PM, I'm not sure if there are any recommend strategies for this?

SCS is something you have to “opt” in to, so unless the admin went and enabled them, then he has no chance.

http://technet.microsoft.com/en-us/windows...r/bb405951.aspx Is the link for the client download he’d need to install on his local system.

One word of warning for restoring from a shadow volume copy, ALWAYS do it from the client, NEVER from the server... like somebody did...

[El Di Pablo]

Once you've enabled SCS on a share you can set the times it will take snapshots, it does it twice daily. I think ours are setup to take copies around 11AM and then again around 4PM...

Exactly. You can set a schedule to automate it. That's how I have it set up at my company. Its a friggin' life saver because somebody always accidentally deletes the wrong file.

[FredMet]

I agree with digip that the process of file recovery depends on how long ago, and how much activity you have had since then. From my experience, I'd recommend you the best restoration program called Advanced File Recovery. I think that with this program you will be able to restore every file that can be restored.

[proskater123]

Well this post is so old that I can' even remember what I was looking for. :P But Im going to play with freenas and have the recycling bin enabled this time :D

[X3N]

short of doing a forensic style analysis it sounds like your pretty much screwed