• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 173
  • Last Modified:

Information Deleted from Shared Drive

Hi guys,

What a Monday.  I just installed a Windows 2003 server on 5/13/2006 out in my other office and I'm using Symantec Backup Exec.  I was running differential backups until Friday 5/19/2006 when I set it to run full backups instead.  It ran a full back up at 11pm on Friday the 19th and then between that and Saturday night, it seems 95% of the files in that shared drive that Symantec is backing up went missing.  I also seem to have an odd number of pings coming in on port 445.  My firewall appears to be blocking them.  

I was able to restore the files from my backup on Friday.

Can anyone please let me know where to go to find out why they were deleted and what to check to see if someone had gotten in to my network?

I very much appreciate any help you can give me.

Thank you so much!

Sherry
0
shoshe
Asked:
shoshe
  • 3
  • 2
1 Solution
 
Irwin SantosComputer Integration SpecialistCommented:
You may want to review your security and application logs in your EVENT VIEWER and see if there was access to those files/shares.

START - ADMINISTRATIVE TOOLS - EVENT VIEWER
0
 
shosheAuthor Commented:
Is there something specific to look for?  I don't seem to have any logs that show access to that shared drive.  But I have users logging on and logging off all night long.  Wouldn't that happen if someone left their computer on?

In the application log, all I have is BackupExec asking for a blank tape over and over again on Sunday.

Thanks so much for your help!

0
 
Irwin SantosComputer Integration SpecialistCommented:
"Wouldn't that happen if someone left their computer on?"

yes

"In the application log, all I have is BackupExec asking for a blank tape over and over again on Sunday."

ok... instead of having the scheduled job run...just execute it and see what happens, post your results.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
Jay_Jay70Commented:
Hi shoshe,

you wont be able to find out unless you had folder audtiting enabled which you didnt - it fills up your event logs something chronic
0
 
shosheAuthor Commented:
It ended up being a stupid screwup.  Data was Archiving, not copying.  I'm soooo dumb!
0
 
Irwin SantosComputer Integration SpecialistCommented:
..whoops... :-)
0

Featured Post

Prep for the ITIL® Foundation Certification Exam

December’s Course of the Month is now available! Enroll to learn ITIL® Foundation best practices for delivering IT services effectively and efficiently.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now