Information Deleted from Shared Drive

Posted on 2006-05-22
Last Modified: 2010-04-18
Hi guys,

What a Monday.  I just installed a Windows 2003 server on 5/13/2006 out in my other office and I'm using Symantec Backup Exec.  I was running differential backups until Friday 5/19/2006 when I set it to run full backups instead.  It ran a full back up at 11pm on Friday the 19th and then between that and Saturday night, it seems 95% of the files in that shared drive that Symantec is backing up went missing.  I also seem to have an odd number of pings coming in on port 445.  My firewall appears to be blocking them.  

I was able to restore the files from my backup on Friday.

Can anyone please let me know where to go to find out why they were deleted and what to check to see if someone had gotten in to my network?

I very much appreciate any help you can give me.

Thank you so much!

Question by:shoshe
    LVL 30

    Accepted Solution

    You may want to review your security and application logs in your EVENT VIEWER and see if there was access to those files/shares.


    Author Comment

    Is there something specific to look for?  I don't seem to have any logs that show access to that shared drive.  But I have users logging on and logging off all night long.  Wouldn't that happen if someone left their computer on?

    In the application log, all I have is BackupExec asking for a blank tape over and over again on Sunday.

    Thanks so much for your help!

    LVL 30

    Expert Comment

    "Wouldn't that happen if someone left their computer on?"


    "In the application log, all I have is BackupExec asking for a blank tape over and over again on Sunday."

    ok... instead of having the scheduled job run...just execute it and see what happens, post your results.
    LVL 48

    Expert Comment

    Hi shoshe,

    you wont be able to find out unless you had folder audtiting enabled which you didnt - it fills up your event logs something chronic

    Author Comment

    It ended up being a stupid screwup.  Data was Archiving, not copying.  I'm soooo dumb!
    LVL 30

    Expert Comment

    ..whoops... :-)

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    It is a known fact that servers reach the end of their lives. Some get there quicker than others, based on age, manufacturer, usage and several other factors. However, if your organization has spent time deploying Microsoft's Active Directory server…
    This may not be a text book method to resolve VSS backup issues but it seemed to have worked on few of the Windows 2003 servers we had issues while performing a Volume Shadow Copy backup. If you have issues while performing a shadow copy backup usin…
    It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
    This video discusses moving either the default database or any database to a new volume.

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now