ewit
asked on
The case of the missing email PST.
The Facts:
Server stores user documents. Some users have outlook .PST files in addition to documents. The server was experiencing HD issues. Decided to offline server and copy user files to external HD. Reason this was done was the server was getting unstable. It was running really slow and eventually crashed.
SO user docs are in two places, original and external HD.
We rebuilt new server and copy the documents over. Remap all users to point to new location.
The problem 1 user is missing 2 years of emails that were stored in PST files.
The PST files on the original location, external location, and 1 week old backup all look similar and are missing the emails.
So there must have been another PST in play that we can't locate. Checked on the users PC and the server but couldn't find a PST file with the missing emails. Does anyone have a clue what could have happened and how?
we checked the outlook hidden directories Outlook.Content, and where the .ost file and .nk2 file are stored. We have high confidence in the user that she is indeed telling the truth that the emails existed.
Her computer did have sync going for her user drive and that sync pointed to the server that was offline not sure if this caused issues.
Server stores user documents. Some users have outlook .PST files in addition to documents. The server was experiencing HD issues. Decided to offline server and copy user files to external HD. Reason this was done was the server was getting unstable. It was running really slow and eventually crashed.
SO user docs are in two places, original and external HD.
We rebuilt new server and copy the documents over. Remap all users to point to new location.
The problem 1 user is missing 2 years of emails that were stored in PST files.
The PST files on the original location, external location, and 1 week old backup all look similar and are missing the emails.
So there must have been another PST in play that we can't locate. Checked on the users PC and the server but couldn't find a PST file with the missing emails. Does anyone have a clue what could have happened and how?
we checked the outlook hidden directories Outlook.Content, and where the .ost file and .nk2 file are stored. We have high confidence in the user that she is indeed telling the truth that the emails existed.
Her computer did have sync going for her user drive and that sync pointed to the server that was offline not sure if this caused issues.
Could it be in archive.pst ?
If you cannot find the pst.. Can you pull it out of backup? I would start there.
HTH,
Kent
HTH,
Kent
Had it been archive PST it would be normally stored under her profile on her machine. You'd get the PST location from her OL - If PST goes missing, OL will not forget the PST location and would keep on trying to find the PST.
Since, you've copied the folders to another location and brought it back - search in the same folder - what ever you get is her PST.
While, she may or may not accept - that is her opinion.
We get to talk to such folks everyday where they'll always deny that those emails were never there in first place. People forget and then starts the blame game.
Regards,
Exchange_Geek
Since, you've copied the folders to another location and brought it back - search in the same folder - what ever you get is her PST.
While, she may or may not accept - that is her opinion.
We get to talk to such folks everyday where they'll always deny that those emails were never there in first place. People forget and then starts the blame game.
Regards,
Exchange_Geek
ASKER
Kent,
PST From the backup matches the PST files from that we have. All three locations show 2 pst files that date back to 2010.
Exchange_geek,
I know this user isn't lying. There are 2 years of emails she is missing kinda backing up the 2010 date of the files.
To everyone else:
Something is gone wrong here. Her my documents folder was redirected to her U: (user drive on the server). We always put PST files in people's U drives ( i know there are reasons against it). U: Drive being a network share on a file server.
For some reason this particular user's PST files regressed 2 years or she had other PST files they have gone missing (Couldn't of been on U cause they would be on backup tape). I personally think the PST files had to be some place else because of the time stamps. The PST files we have are dated to 2010. They exist in the User drive, the file copy of that drive as well as the tape backup. All implies she must not have used these PST files. So what happened to the current 2012 PST files?
My best guess with no proof is MS sync just destroyed her PST files somehow. I guess this would happen when windows assumed that the old ones dated 2010 were somehow more relevant than her current ones. The syncing must not have been working properly over the years and moving around the server shares somehow caused a sync.
I really don't know what happened here and I'm a bit uncomfortable with it as I feel there always is an answer in the computer world. I don't like to tell my users I don't have their file and they are on their own.
PST From the backup matches the PST files from that we have. All three locations show 2 pst files that date back to 2010.
Exchange_geek,
I know this user isn't lying. There are 2 years of emails she is missing kinda backing up the 2010 date of the files.
To everyone else:
Something is gone wrong here. Her my documents folder was redirected to her U: (user drive on the server). We always put PST files in people's U drives ( i know there are reasons against it). U: Drive being a network share on a file server.
For some reason this particular user's PST files regressed 2 years or she had other PST files they have gone missing (Couldn't of been on U cause they would be on backup tape). I personally think the PST files had to be some place else because of the time stamps. The PST files we have are dated to 2010. They exist in the User drive, the file copy of that drive as well as the tape backup. All implies she must not have used these PST files. So what happened to the current 2012 PST files?
My best guess with no proof is MS sync just destroyed her PST files somehow. I guess this would happen when windows assumed that the old ones dated 2010 were somehow more relevant than her current ones. The syncing must not have been working properly over the years and moving around the server shares somehow caused a sync.
I really don't know what happened here and I'm a bit uncomfortable with it as I feel there always is an answer in the computer world. I don't like to tell my users I don't have their file and they are on their own.
Did you check if user has some Auto-acrhiving set with PST location ?
MS sync can be discontinued but cannot remove or delete the PST :(
Did you check the data inside those PST's on users machine apart from their date ?
Of the user had those files on the U:\ drive surely you will have a backup of those at a certain time maybe 2 weeks ago from the removal or even a few months old ..... right
If everything is fine check if user has some USB or any other shared folder that is being used ?
Also couldn't it be that users Shared location\Home drive changed and caused this mis-understanding ?
- Rancy
MS sync can be discontinued but cannot remove or delete the PST :(
Did you check the data inside those PST's on users machine apart from their date ?
Of the user had those files on the U:\ drive surely you will have a backup of those at a certain time maybe 2 weeks ago from the removal or even a few months old ..... right
If everything is fine check if user has some USB or any other shared folder that is being used ?
Also couldn't it be that users Shared location\Home drive changed and caused this mis-understanding ?
- Rancy
Friend,
All i can tell you is if the PST isn't on the users machine NOR on your drive. It's history, sounds a bit rude - but you and i both know that its gone.
Regards,
Exchange_Geek
All i can tell you is if the PST isn't on the users machine NOR on your drive. It's history, sounds a bit rude - but you and i both know that its gone.
Regards,
Exchange_Geek
ASKER
Exchange_geek,
I do tend to agree. I just want to understand why? You can almost always explain processes on a pc in some way as to what happened. With the proper knowledge of course. Why are you so certain is it the evidence I provided or have you ran into something like this before yourself?
I do tend to agree. I just want to understand why? You can almost always explain processes on a pc in some way as to what happened. With the proper knowledge of course. Why are you so certain is it the evidence I provided or have you ran into something like this before yourself?
I've burnt my hands on such issues before, where in customer would save the PST on a shared location - that they know of, for some reason the location wouldn't exist in future OR the server was decommissioned OR some USB Drive was removed and they've lost their emails.
In spite of us restoring xyz files from any number of months - no data was ever retrieved, it was on such instances where we had to tell them - WHY aren't they saving files locally.
Also, some folks use the feature of Archive PST and when their boxes gets formatt'd OR re-profile'd - at those instances such hue and cry happens - we spend money on restoring data using file recovery softwares to get back data that they want. Some time we are successful and some times not.
So, in your case that is the reason I said, if you cannot find it on the server AND you cannot find it locally. Well, that sounds bad news for the user.
Regards,
Exchange_Geek
In spite of us restoring xyz files from any number of months - no data was ever retrieved, it was on such instances where we had to tell them - WHY aren't they saving files locally.
Also, some folks use the feature of Archive PST and when their boxes gets formatt'd OR re-profile'd - at those instances such hue and cry happens - we spend money on restoring data using file recovery softwares to get back data that they want. Some time we are successful and some times not.
So, in your case that is the reason I said, if you cannot find it on the server AND you cannot find it locally. Well, that sounds bad news for the user.
Regards,
Exchange_Geek
ASKER
Rancy,
I didn't see auto-archiving enabled but i will recheck this.
OK so MS Sync won't delete a PST even if the same name but older file exists in the directory.
Yes I checked the data, I looked at all the PST's. PST Sources included:
1)what we thought was current copied file from the source.
2)the source of the copy (original failing server).
3)two week old backup tape.
Yes had a backup but it doesn't have a newer PST than 2010.
i checked the users computer for *.pst files found nothing.
-yes the change somehow did cause the misunderstanding or in this case missing files/emails. All the other users that have their files intact this particular user lost her latest PST Files.
I didn't see auto-archiving enabled but i will recheck this.
OK so MS Sync won't delete a PST even if the same name but older file exists in the directory.
Yes I checked the data, I looked at all the PST's. PST Sources included:
1)what we thought was current copied file from the source.
2)the source of the copy (original failing server).
3)two week old backup tape.
Yes had a backup but it doesn't have a newer PST than 2010.
i checked the users computer for *.pst files found nothing.
-yes the change somehow did cause the misunderstanding or in this case missing files/emails. All the other users that have their files intact this particular user lost her latest PST Files.
ASKER
Geek,
What software do you use to recover such files. I scanned her PC using some cheap freeware that shows deleted files but I didn't really see anything that looked like a PST. Maybe you use some fancier software.
What software do you use to recover such files. I scanned her PC using some cheap freeware that shows deleted files but I didn't really see anything that looked like a PST. Maybe you use some fancier software.
Pretty much everything that doesn't require to shell out money ;)
http://www.piriform.com/recuva
http://www.snapfiles.com/get/restoration.html
http://www.officerecovery.com/freeundelete/
Regards,
Exchange_Geeek
http://www.piriform.com/recuva
http://www.snapfiles.com/get/restoration.html
http://www.officerecovery.com/freeundelete/
Regards,
Exchange_Geeek
ASKER
OK Thanks to Recuva I may have gotten another clue as to what happened.
I found what looks like the PST files down to the date and time of the incident 8/2/2012 @8:30AM. This is exactly the time that an admin disconnected the PST file from the user.
What i don't understand is why they are sitting in that directory. There also seems to be multiple copies of the same file in the same directory according the the recovery tool. Not sure if that's just a byproduct of a file that was over written and got scattered.
The said directory is:
C:\Windows\CSC\v2.0.6\name
i replaced actual server and username with the %variables%.
Unfortunately the PST's have been over written by other files and their sizes are really really tiny. 16KB's and 43KB's. The state is unrecoverable.
So it seems that recovery is not possible. However, this may answer a question or two as to how this incident occurred.
Why is the PST file sitting in this fortified CSC folder (very strict permissions)?
What is the function of that Directory in windows in general?
Why would outlook leave a file there when it was supposed to be mapped to a User drive?
I found what looks like the PST files down to the date and time of the incident 8/2/2012 @8:30AM. This is exactly the time that an admin disconnected the PST file from the user.
What i don't understand is why they are sitting in that directory. There also seems to be multiple copies of the same file in the same directory according the the recovery tool. Not sure if that's just a byproduct of a file that was over written and got scattered.
The said directory is:
C:\Windows\CSC\v2.0.6\name
i replaced actual server and username with the %variables%.
Unfortunately the PST's have been over written by other files and their sizes are really really tiny. 16KB's and 43KB's. The state is unrecoverable.
So it seems that recovery is not possible. However, this may answer a question or two as to how this incident occurred.
Why is the PST file sitting in this fortified CSC folder (very strict permissions)?
What is the function of that Directory in windows in general?
Why would outlook leave a file there when it was supposed to be mapped to a User drive?
CSC is offline cache folder that windows create
Read in detail why and how of this folder
http://blogs.msdn.com/b/oldnewthing/archive/2003/08/27/54712.aspx
Regards,
Exchange_Geek
P.S - keep that tool handy, it did help me and would help you too :)
Read in detail why and how of this folder
http://blogs.msdn.com/b/oldnewthing/archive/2003/08/27/54712.aspx
Regards,
Exchange_Geek
P.S - keep that tool handy, it did help me and would help you too :)
ASKER
So geek...
did M$ sync delete the files after the server name changed and it found some really old PST files in the newly mapped drive?
Those old PST files were exactly what they should of been syncing too all along but something broke and it couldn't sync over the last two years? So the last two years it ran in cache mode?
Then out of the blue it decided to ditch the cached files?
did M$ sync delete the files after the server name changed and it found some really old PST files in the newly mapped drive?
Those old PST files were exactly what they should of been syncing too all along but something broke and it couldn't sync over the last two years? So the last two years it ran in cache mode?
Then out of the blue it decided to ditch the cached files?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
With 16KB's and 43KB's .... its like nothing in them.
Wired things happen ones in a while and not much can be done than to move ahead :(
Rest i guess Exchange_Geek has mostly answered the queries ..... however if still any issues do let us know.
- Rancy
Wired things happen ones in a while and not much can be done than to move ahead :(
Rest i guess Exchange_Geek has mostly answered the queries ..... however if still any issues do let us know.
- Rancy