earthwing
asked on
Recovery of a ntbackup file
I have a default ntbackup running on a SBS 2003 box backing up to a hard drive. By default it keeps 2 days worth of backups.
Small Business Server Backup (01).bkf (Wednesday backup)
Small Business Server Backup (02).bkf (Tuesday backup)
This week (on Monday) a user completly deleted the contents in the My Docs folder and did not tell me till this AM (thursday). Needless to say i have backups of tuesday night and last night. I do not know how NTBackup handles the existing previous backup file name, i.e. do they delete it , overwrite it ? Any way sto recover the Monday backup? I will be happy to purchase some recovery software if need be (suggestions of software will be appreciated)
There is very little other disk activity on the drive.
Thanks
Small Business Server Backup (01).bkf (Wednesday backup)
Small Business Server Backup (02).bkf (Tuesday backup)
This week (on Monday) a user completly deleted the contents in the My Docs folder and did not tell me till this AM (thursday). Needless to say i have backups of tuesday night and last night. I do not know how NTBackup handles the existing previous backup file name, i.e. do they delete it , overwrite it ? Any way sto recover the Monday backup? I will be happy to purchase some recovery software if need be (suggestions of software will be appreciated)
There is very little other disk activity on the drive.
Thanks
Doh, just wrote a long reply for this then failed when I hit submit.... try again.
Basic suggestion was..... don't think you'll have much luck getting hte file back directly as even one bit overwritten and ntbackup will probably not see the file as Ok to restore from.
Suggested taking a full backup on Monday to full backup.bkf and daily incremental backups appending to daily.bkf
You MAY be in luck if someone has turned on volume shadow copies. if so go to the properties of the drive on the server itself and look at the shadow copies tab. If it is turned on your server is keeping snapshot copies of your files as they change. You can get to those from the server (or a PC once a piece of client s/w is installed) by going to the share (evem on the server) with \\server\share, e.g. \\server\d$ and right click on a dir or file and choose previous file.
http://www.microsoft.com/windowsserver2003/techinfo/overview/scr.mspx
If it isn't on and you have some free disc space suggest you turn it on!
Steve
Basic suggestion was..... don't think you'll have much luck getting hte file back directly as even one bit overwritten and ntbackup will probably not see the file as Ok to restore from.
Suggested taking a full backup on Monday to full backup.bkf and daily incremental backups appending to daily.bkf
You MAY be in luck if someone has turned on volume shadow copies. if so go to the properties of the drive on the server itself and look at the shadow copies tab. If it is turned on your server is keeping snapshot copies of your files as they change. You can get to those from the server (or a PC once a piece of client s/w is installed) by going to the share (evem on the server) with \\server\share, e.g. \\server\d$ and right click on a dir or file and choose previous file.
http://www.microsoft.com/windowsserver2003/techinfo/overview/scr.mspx
If it isn't on and you have some free disc space suggest you turn it on!
Steve
ASKER
Thank I do have shadow copies enabled. However I am concerned that if I run it direct from the server it will move eveythig back to that day. Can any one tell me if I run it if I can pick and choose the files to restore (i.e. my docs folder) only for a specific user?
If you right click the folder (from \\server\share UNC and choose previuous versions it will open up another explorer windows "foldername on dd-mm-yy" effectively. You can drag and drop to the original location to restore the files you want -- no easy way to just do one users files though unless they are in a known dir.
I like volume shadow copy, has got a lot of people out of trouble when their backups are poor... no full substitute though of course
good luck
Steve
I like volume shadow copy, has got a lot of people out of trouble when their backups are poor... no full substitute though of course
good luck
Steve
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Thanks, guess that worked then!
And thanks for taking me over the 150,000 points mark in this area... now for the 300,000 mark!
And thanks for taking me over the 150,000 points mark in this area... now for the 300,000 mark!
anyway the more time you wait the bigger is the chance that the deleted file is completely lost as the blocks on the hard drive are going to be more likely rewritten