Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

volume shadow copy had disappeared

Posted on 2014-02-15
4
Medium Priority
?
261 Views
Last Modified: 2014-10-24
I was using a shadow copy to restore files that had been encrypted by a virus.  Halfway through that process, Windows (apparently) decide I no longer needed that file.  My question is, where is it?  The other shadow copies are all too new; I need one (the one) that existed before the virus hit.
0
Comment
Question by:mspink
  • 2
4 Comments
 
LVL 96

Accepted Solution

by:
Lee W, MVP earned 2000 total points
ID: 39861051
It's probably gone - removed because you had allocated only so much space to shadow copies and the copy schedule needed that space.  Especially if you see other copies, I would expect that's the case - you'll have to go to your backups (the ones you use in the event your hard drive(s) fail).
0
 

Author Comment

by:mspink
ID: 39861054
I can appreciate that it is "probably gone", but how does one know that for sure.  For whatever reason, these files are missing from the backup sets, so  I think this could be my only shot at recovery.  Where would it be if not gone?
0
 
LVL 96

Expert Comment

by:Lee W, MVP
ID: 39861087
Shadow copy does NOT store actual files.  It stores changed blocks.  Since it sounds like you were hit with CryptoLocker, all files have had all their blocks changed.  So ShadowCopy probably lost everything (or nearly everything) prior.  I say probably because maybe I'm missing something but my understanding of the technology and the description of the situation says to me 99.9% certain the previous copies are gone.  If you had disabled the scheduled tasks that create the copies you could have recovered... but now, I think you're out of luck.
0
 
LVL 11

Expert Comment

by:Pradeep Dubey
ID: 39861089
vssadmin list shadows

also you can use vshadow for all vss related options.

First of all you need the date of infection then list out all the shadow copies.

Check if you have before infection date shadow copy.

probably gone: It can be happen when you have low disk space for the new shadow and new shadow creation schedule is comes. In this case it will overwite oldest one. you will not get that one again as it is deleted by the system.

For more information and command line option read below link:
http://krypted.com/windows-server/shadow-copy-from-the-command-line/
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Back in July, I blogged about how Microsoft's new server pricing model, combined with the end of the Small Business Server package, would result in significant cost increases for many small businesses (see SBS End of Life: Microsoft Punishes Small B…
I have put this article together as i needed to get all the information that might be available already into one general document that could be referenced once without searching the Internet for the different pieces. I have had a few issues where…
This video shows how to quickly and easily deploy an email signature for all users in Office 365 and prevent it from being added to replies and forwards. (the resulting signature is applied on the server level in Exchange Online) The email signat…
In response to a need for security and privacy, and to continue fostering an environment members can turn to for support, solutions, and education, Experts Exchange has created anonymous question capabilities. This new feature is available to our Pr…

877 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question