Solved

A user deleted their files from a network drive.  Backup is corrupt - how to get files back

Posted on 2008-06-17
29
455 Views
Last Modified: 2012-06-27
A user thought they were deleting a few files from network drive and ntoiced many files being deleted and cancelled it before it deleted the entire folder.  I have run winundelete and the files are scattered all over the place and some of them are not readable. Does anyone know of a decent piece of software (free is good) or wiling to pay for a recovery software.  Mainly word and excell files orgnized in many folders and sub folders.  Using Windows 2003 server client windows xp professional.   My backup is very small and is not good when I try to restore it.
0
Comment
Question by:manch03
  • 15
  • 14
29 Comments
 
LVL 3

Expert Comment

by:supdawgtt94
ID: 21808344
I've had very good results with R-Studio.  It's not free, but I've been able to recover files that other recovery software could not.

They offer free evaluation to see if it would be useful for you.

http://www.data-recovery-software.net/
0
 

Author Comment

by:manch03
ID: 21808599
Will it recover them in a format that is easy to restore - this user had folders inside of folder inside of folders and the files were located in the various folders.  I have run a few recovery software apps and it dumps them in to unnamed folders with numbers so that we have to open every one of them to see what the files are.
0
 

Author Comment

by:manch03
ID: 21808604
There are hundreds of files to recover.
0
 
LVL 3

Expert Comment

by:supdawgtt94
ID: 21808630
It will recover them to a recovery folder (do not recover to the same drive as you are recovering from) in the hierarchy it was deleted in if it finds the directory tree you lost.  If the filesystem structure was destroyed, the filename may be lost, which is why you'll see numbers and names.  After the software runs its scan, it'll show you a directory tree from which you check the folders/files you want to recover.

In any case, I've recovered files using this program with folders in subfolders with the names intact that were lost after repartition task failed (unfortunately not all files were recovered due to some being overwritten).

Your best bet is to give the software a try.  Again, I'm sure aware of this, but make sure you do not write any more data to the same partition as the deleted files or you may overwrite the deleted file's sectors.
0
 

Author Comment

by:manch03
ID: 21808671
Ok - I will give it a try - I was copying the files I could recover from the other software back into the user's drive.  Hopefully I did not write over additional files.  
0
 

Author Comment

by:manch03
ID: 21808748
Do you install the software on the same server or should I install it on another server and then navigate to the drive I want to recover?
0
 
LVL 3

Expert Comment

by:supdawgtt94
ID: 21808939
Data recovery is always a PITA because if you write to the same partition as the lost data, you run the risk of corrupting the data bits that you want to recover.

Install the software on another computer and see if it can access the drive you want to recover.  The software is supposed to be able to do that (I have not tried this feature).  Or you could try the emergency boot disc, if it comes with the demo. If not, you may have to create a temporary boot OS on an external drive and install the recovery software on that drive.  Alternatively, you can take the drive with the data, install it on another computer as a second drive, install the software on the 2nd computer's hard drive and run the recovery.
0
 

Author Comment

by:manch03
ID: 21808965
I installed it on another server and tried saving the recovered data to a network drive, but it errored out on me - trying on another workstation.
0
 
LVL 3

Accepted Solution

by:
supdawgtt94 earned 500 total points
ID: 21808993
BTW.  If the computer with the lost data is still running processes and/or people are writing to the partition, you should shut it down/restrict write access immediately.  Windows doesn't necessarily overwrite previously deleted sectors, but if you continue to write to the drive, it can and will overwrite deleted file data, corrupting the lost data, making recovery impossible.

You may want to review your data integrity plan due to this user mishap.  I have our system backup doing multiple backups to overcome the potential for lost data.  I have a rotation of 3 hard drive backup drives, each drive holding 1 week of data.  At the beginning of a drive's rotation, it does a full backup.  Afterwards, it does an hourly differential backup to the same drive.  The day before the next rotational full backup, I switch to the next hard drive.  This allows me to have multiple backups, the latest being an hour old, the next latest being a week old, and the last being 2 weeks old.  On top of that, we pay for online backups for the most critical data.  It's less than 20 gigs worth, but this is data that if the HDD was to get destroyed, we would need to recover no matter what.  This gets backed up over the internet to a service provider's system using their software on a daily basis and it's encrypted.  My backup also consists of a monthly archival to tape, but it's less useful for us than the real-time backups onto HDD and online.  The online backup costs us $100/year for 50 GB of data, which is very cheap (Mozy.com).
0
 
LVL 3

Expert Comment

by:supdawgtt94
ID: 21808999
Try to recover the data onto the same machine as the recovery software.  Obviously you'll need enough storage space for the recovered files.
0
 

Author Comment

by:manch03
ID: 21809575
I installed the software - tried to recover some of the word documents and they are gobbly goop - Why are they like this?
0
 

Author Comment

by:manch03
ID: 21809597
The recovery software does allow me to access the network drive that had the original files deleted.  If the drive files are on the D drive and I installed the software on the C drive, will the software write over the drive D files that I need to recover?  The word files that come up just look strange - even the word program looks weird.  It looks like it is a different version than the one we use but I do not know how that could be...  We use office 2003 and the word files that are coming up with weird characters do not look like Office 2003 files.  They look like Office 2007 files.
0
 
LVL 3

Expert Comment

by:supdawgtt94
ID: 21809605
If you install on C, and the data is on D, that is ok.

If the file becomes incomplete due to parts of a file's deleted sectors being overwritten, then a recovered file will be corrupt, even though it is "recovered".  That is why if data is lost, the drive must not be written to until the recovery is done.  Most likely, other users and/or processes were writing to the share drive and have corrupted your chance to undelete the data.
0
 
LVL 3

Expert Comment

by:supdawgtt94
ID: 21809609
The software should color code files that is corrupt.  I forget what the colors are for complete files vs. incomplete files, but you should be able to see what your chance of recovery is within the software.  I would continue to try to recover all the files, because some of them may be good.
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 

Author Comment

by:manch03
ID: 21809619
I have the data on D and I installed the software on C - Yes this is a busy time of year when users are saving to this network drive to close out the school year.  I should not allow any access?  To make matters worse, the other techs were installing a new server and accidentally unplugged this server while I was in the middle of trying to restore with winundelete software.  I did retrieve quite a few files, but it seems after the reboot files were corrupt.
0
 
LVL 3

Expert Comment

by:supdawgtt94
ID: 21809622
I just reread your original post.  If you tried to undelete to the original location, that may have ruined your chances of recovering the deleted files and unfortunately, I don't think complete data integrity is there anymore for your deleted files.  Doesn't hurt to continue to try, though.
0
 

Author Comment

by:manch03
ID: 21809623
One more thing - the files that are being recovered have the name of the file correct, but the content of the file itself is someone else's file.  Very strange.
0
 

Author Comment

by:manch03
ID: 21809626
I used winundelete software but saved to a different drive - not to the original location.
0
 
LVL 3

Expert Comment

by:supdawgtt94
ID: 21809636
Ouch.  Sounds like a mess.  Keep seeing if the software can recover your files.  But as I wrote, it may be a lost cause due to all the unfortunate circumstances you mentioned (winundelete failure with power outage, users continuing to write to the drive, restoring files to the same drive).  A deleted file is only undeletable if all the sectors containing a file's data is not overwritten.
0
 
LVL 3

Expert Comment

by:supdawgtt94
ID: 21809663
Oh?  I though you said you used winundelete to copy the files back to the user's drive.

If the filename is the same, but the data isn't, it's an obvious sign that the sector's been overwritten.

The NTFS filesystem has a map of where a file's first sector is, with the next sector chain described in that first sector.  The recovery tries to follow that chain and copy the data in the sectors into a new file, and it doesn't know if a sector is the original data or not.
0
 

Author Comment

by:manch03
ID: 21811504
Ok - would  a last known good configuration of the server to a restore point two days ago do any good?
0
 

Author Comment

by:manch03
ID: 21811637
What about all this software that advertises restores after drives have been erased?  Is there nothing out there that would restore these files?
0
 
LVL 3

Expert Comment

by:supdawgtt94
ID: 21813410
System restore will not restore lost user data.  It's used to restore the system files back to a known state only.  A backup is the only way to recover lost user data.

Sorry to give the bad news, but unfortunately, software that advertises file restoration all assume that the drive is no longer written to.  If you think about it, a hard drive simply stores data as 1's and 0's.  The pattern of 1's and 0's define the data, but if you change that pattern, it's no longer the same data.  As long as nothing is written to the drive, that pattern remains on the disc platter, which allows the software to restore deleted files.  But if something either resets the deleted sector with 0's or 1's (secure delete), or overwrites the sector with a different pattern (other files being saved to the drive), you've lost the original data and there's nothing out that can restore that.  Even forensic data recovery (such as fire damage) can only retrieve data that hasn't been modified.
0
 

Author Comment

by:manch03
ID: 21813886
I do have a backup but it is telling me that the backup file contains unrecognized data and cannot be used when trying to restore.
0
 
LVL 3

Expert Comment

by:supdawgtt94
ID: 21814316
What backup software are you using?
0
 

Author Comment

by:manch03
ID: 21814419
The windows back up - I have the back up going to an external hard drive on a domain controller.  the files are all there, I get this message when I try any of them.
0
 
LVL 3

Expert Comment

by:supdawgtt94
ID: 21814598
I'm assuming you're talking about Microsoft NTBackup.  Give this software a try on a copy of your backup files:

http://www.bkfrepairtool.com/backup-file-contains-unrecognized-data.html
0
 
LVL 3

Expert Comment

by:supdawgtt94
ID: 21814653
Here's a comment regarding someone's problems with NTBackup:

"The version of NTbackup is correct for Windows 2003 SP1. Can you log onto
the workstation that contains the backup files (as a domain admin) and push
(copy) the "(01) backup file" to the server?

On the (01) backup file, make sure the Backup Operators group,
Administrators group and System all have Full Control in the Security
permissions tab. Maybe even add Domains Admin group with Full Control. You
may even want to check ownership on the Backup folder and have your domain
admin account "take ownership" of it.

Also, in the Restore and Manage Media tab in NTBackup, before you attempt to
select the target file, can you catalog the (01) backup file, then proceed
with the restore? (Tools | Catalog a backup file)

You might also try mapping \\Homedesk2\BigDisk (F)\Backup Files to
your server and then try to access it as a drive letter.

You might also try adding your user account to the Backup Operators Security
Group on the server.

And try logging into the server console for the restore (not through a
remote desktop session).

--
Merv Porter [SBS MVP]
==================================="

Here's the original thread: http://www.mombu.com/microsoft/windows-small-business-server-2003/t-the-backup-file-contains-unrecognized-data-and-cannot-be-used-751567.html
0
 

Author Comment

by:manch03
ID: 21818483
These were all good suggestions but unfortunately none recovered the data.  I did end up using getbackdata and that did a decent job of saving what was recoverable with a friendly interface.  I will award the points because I used all the suggestions and it was informaton I will keep for future reference - hopefully I will not go through this again with the good backup plan mentioned above.
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Replication has always been one of those technologies that people run scared from. The main reason is usually cost. When you think of replication, your mind drifts to solutions that replicate from one disk frame to another using block level technolo…
The article will include the best Data Recovery Tools along with their Features, Capabilities, and their Download Links. Hope you’ll enjoy it and will choose the one as required by you.
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This tutorial will walk an individual through the process of installing of Data Protection Manager on a server running Windows Server 2012 R2, including the prerequisites. Microsoft .Net 3.5 is required. To install this feature, go to Server Manager…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now