• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 472
  • Last Modified:

A user deleted their files from a network drive. Backup is corrupt - how to get files back

A user thought they were deleting a few files from network drive and ntoiced many files being deleted and cancelled it before it deleted the entire folder.  I have run winundelete and the files are scattered all over the place and some of them are not readable. Does anyone know of a decent piece of software (free is good) or wiling to pay for a recovery software.  Mainly word and excell files orgnized in many folders and sub folders.  Using Windows 2003 server client windows xp professional.   My backup is very small and is not good when I try to restore it.
0
manch03
Asked:
manch03
  • 15
  • 14
1 Solution
 
supdawgtt94Commented:
I've had very good results with R-Studio.  It's not free, but I've been able to recover files that other recovery software could not.

They offer free evaluation to see if it would be useful for you.

http://www.data-recovery-software.net/
0
 
manch03Author Commented:
Will it recover them in a format that is easy to restore - this user had folders inside of folder inside of folders and the files were located in the various folders.  I have run a few recovery software apps and it dumps them in to unnamed folders with numbers so that we have to open every one of them to see what the files are.
0
 
manch03Author Commented:
There are hundreds of files to recover.
0
Cloud Class® Course: Certified Penetration Testing

This CPTE Certified Penetration Testing Engineer course covers everything you need to know about becoming a Certified Penetration Testing Engineer. Career Path: Professional roles include Ethical Hackers, Security Consultants, System Administrators, and Chief Security Officers.

 
supdawgtt94Commented:
It will recover them to a recovery folder (do not recover to the same drive as you are recovering from) in the hierarchy it was deleted in if it finds the directory tree you lost.  If the filesystem structure was destroyed, the filename may be lost, which is why you'll see numbers and names.  After the software runs its scan, it'll show you a directory tree from which you check the folders/files you want to recover.

In any case, I've recovered files using this program with folders in subfolders with the names intact that were lost after repartition task failed (unfortunately not all files were recovered due to some being overwritten).

Your best bet is to give the software a try.  Again, I'm sure aware of this, but make sure you do not write any more data to the same partition as the deleted files or you may overwrite the deleted file's sectors.
0
 
manch03Author Commented:
Ok - I will give it a try - I was copying the files I could recover from the other software back into the user's drive.  Hopefully I did not write over additional files.  
0
 
manch03Author Commented:
Do you install the software on the same server or should I install it on another server and then navigate to the drive I want to recover?
0
 
supdawgtt94Commented:
Data recovery is always a PITA because if you write to the same partition as the lost data, you run the risk of corrupting the data bits that you want to recover.

Install the software on another computer and see if it can access the drive you want to recover.  The software is supposed to be able to do that (I have not tried this feature).  Or you could try the emergency boot disc, if it comes with the demo. If not, you may have to create a temporary boot OS on an external drive and install the recovery software on that drive.  Alternatively, you can take the drive with the data, install it on another computer as a second drive, install the software on the 2nd computer's hard drive and run the recovery.
0
 
manch03Author Commented:
I installed it on another server and tried saving the recovered data to a network drive, but it errored out on me - trying on another workstation.
0
 
supdawgtt94Commented:
BTW.  If the computer with the lost data is still running processes and/or people are writing to the partition, you should shut it down/restrict write access immediately.  Windows doesn't necessarily overwrite previously deleted sectors, but if you continue to write to the drive, it can and will overwrite deleted file data, corrupting the lost data, making recovery impossible.

You may want to review your data integrity plan due to this user mishap.  I have our system backup doing multiple backups to overcome the potential for lost data.  I have a rotation of 3 hard drive backup drives, each drive holding 1 week of data.  At the beginning of a drive's rotation, it does a full backup.  Afterwards, it does an hourly differential backup to the same drive.  The day before the next rotational full backup, I switch to the next hard drive.  This allows me to have multiple backups, the latest being an hour old, the next latest being a week old, and the last being 2 weeks old.  On top of that, we pay for online backups for the most critical data.  It's less than 20 gigs worth, but this is data that if the HDD was to get destroyed, we would need to recover no matter what.  This gets backed up over the internet to a service provider's system using their software on a daily basis and it's encrypted.  My backup also consists of a monthly archival to tape, but it's less useful for us than the real-time backups onto HDD and online.  The online backup costs us $100/year for 50 GB of data, which is very cheap (Mozy.com).
0
 
supdawgtt94Commented:
Try to recover the data onto the same machine as the recovery software.  Obviously you'll need enough storage space for the recovered files.
0
 
manch03Author Commented:
I installed the software - tried to recover some of the word documents and they are gobbly goop - Why are they like this?
0
 
manch03Author Commented:
The recovery software does allow me to access the network drive that had the original files deleted.  If the drive files are on the D drive and I installed the software on the C drive, will the software write over the drive D files that I need to recover?  The word files that come up just look strange - even the word program looks weird.  It looks like it is a different version than the one we use but I do not know how that could be...  We use office 2003 and the word files that are coming up with weird characters do not look like Office 2003 files.  They look like Office 2007 files.
0
 
supdawgtt94Commented:
If you install on C, and the data is on D, that is ok.

If the file becomes incomplete due to parts of a file's deleted sectors being overwritten, then a recovered file will be corrupt, even though it is "recovered".  That is why if data is lost, the drive must not be written to until the recovery is done.  Most likely, other users and/or processes were writing to the share drive and have corrupted your chance to undelete the data.
0
 
supdawgtt94Commented:
The software should color code files that is corrupt.  I forget what the colors are for complete files vs. incomplete files, but you should be able to see what your chance of recovery is within the software.  I would continue to try to recover all the files, because some of them may be good.
0
 
manch03Author Commented:
I have the data on D and I installed the software on C - Yes this is a busy time of year when users are saving to this network drive to close out the school year.  I should not allow any access?  To make matters worse, the other techs were installing a new server and accidentally unplugged this server while I was in the middle of trying to restore with winundelete software.  I did retrieve quite a few files, but it seems after the reboot files were corrupt.
0
 
supdawgtt94Commented:
I just reread your original post.  If you tried to undelete to the original location, that may have ruined your chances of recovering the deleted files and unfortunately, I don't think complete data integrity is there anymore for your deleted files.  Doesn't hurt to continue to try, though.
0
 
manch03Author Commented:
One more thing - the files that are being recovered have the name of the file correct, but the content of the file itself is someone else's file.  Very strange.
0
 
manch03Author Commented:
I used winundelete software but saved to a different drive - not to the original location.
0
 
supdawgtt94Commented:
Ouch.  Sounds like a mess.  Keep seeing if the software can recover your files.  But as I wrote, it may be a lost cause due to all the unfortunate circumstances you mentioned (winundelete failure with power outage, users continuing to write to the drive, restoring files to the same drive).  A deleted file is only undeletable if all the sectors containing a file's data is not overwritten.
0
 
supdawgtt94Commented:
Oh?  I though you said you used winundelete to copy the files back to the user's drive.

If the filename is the same, but the data isn't, it's an obvious sign that the sector's been overwritten.

The NTFS filesystem has a map of where a file's first sector is, with the next sector chain described in that first sector.  The recovery tries to follow that chain and copy the data in the sectors into a new file, and it doesn't know if a sector is the original data or not.
0
 
manch03Author Commented:
Ok - would  a last known good configuration of the server to a restore point two days ago do any good?
0
 
manch03Author Commented:
What about all this software that advertises restores after drives have been erased?  Is there nothing out there that would restore these files?
0
 
supdawgtt94Commented:
System restore will not restore lost user data.  It's used to restore the system files back to a known state only.  A backup is the only way to recover lost user data.

Sorry to give the bad news, but unfortunately, software that advertises file restoration all assume that the drive is no longer written to.  If you think about it, a hard drive simply stores data as 1's and 0's.  The pattern of 1's and 0's define the data, but if you change that pattern, it's no longer the same data.  As long as nothing is written to the drive, that pattern remains on the disc platter, which allows the software to restore deleted files.  But if something either resets the deleted sector with 0's or 1's (secure delete), or overwrites the sector with a different pattern (other files being saved to the drive), you've lost the original data and there's nothing out that can restore that.  Even forensic data recovery (such as fire damage) can only retrieve data that hasn't been modified.
0
 
manch03Author Commented:
I do have a backup but it is telling me that the backup file contains unrecognized data and cannot be used when trying to restore.
0
 
supdawgtt94Commented:
What backup software are you using?
0
 
manch03Author Commented:
The windows back up - I have the back up going to an external hard drive on a domain controller.  the files are all there, I get this message when I try any of them.
0
 
supdawgtt94Commented:
I'm assuming you're talking about Microsoft NTBackup.  Give this software a try on a copy of your backup files:

http://www.bkfrepairtool.com/backup-file-contains-unrecognized-data.html
0
 
supdawgtt94Commented:
Here's a comment regarding someone's problems with NTBackup:

"The version of NTbackup is correct for Windows 2003 SP1. Can you log onto
the workstation that contains the backup files (as a domain admin) and push
(copy) the "(01) backup file" to the server?

On the (01) backup file, make sure the Backup Operators group,
Administrators group and System all have Full Control in the Security
permissions tab. Maybe even add Domains Admin group with Full Control. You
may even want to check ownership on the Backup folder and have your domain
admin account "take ownership" of it.

Also, in the Restore and Manage Media tab in NTBackup, before you attempt to
select the target file, can you catalog the (01) backup file, then proceed
with the restore? (Tools | Catalog a backup file)

You might also try mapping \\Homedesk2\BigDisk (F)\Backup Files to
your server and then try to access it as a drive letter.

You might also try adding your user account to the Backup Operators Security
Group on the server.

And try logging into the server console for the restore (not through a
remote desktop session).

--
Merv Porter [SBS MVP]
==================================="

Here's the original thread: http://www.mombu.com/microsoft/windows-small-business-server-2003/t-the-backup-file-contains-unrecognized-data-and-cannot-be-used-751567.html
0
 
manch03Author Commented:
These were all good suggestions but unfortunately none recovered the data.  I did end up using getbackdata and that did a decent job of saving what was recoverable with a friendly interface.  I will award the points because I used all the suggestions and it was informaton I will keep for future reference - hopefully I will not go through this again with the good backup plan mentioned above.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: CompTIA Healthcare IT Tech

This course will help prep you to earn the CompTIA Healthcare IT Technician certification showing that you have the knowledge and skills needed to succeed in installing, managing, and troubleshooting IT systems in medical and clinical settings.

  • 15
  • 14
Tackle projects and never again get stuck behind a technical roadblock.
Join Now