none
Missing Files, Removed Drive and Drive Letter Changes RRS feed

  • Question

  • Hi Guys,

    I have come across a rather odd situation where the last 3 weeks of files from a shared location (DFS Namespace) on a Windows Server 2012 R2 file server have been Deleted.

    What has happened up to this point:

    1. Robocopied existing files from old drive (T:) to a new drive (F:)
    2. Ran backups through Veeam
    3. Renamed the old drive (G:) and the new drive to (T:)
    4. Left both drives in place for 3 weeks
    5. Removed the old drive from the Server
    6. Discovered 3 weeks of files are now missing

    DFS Replication had also been setup on this location and disabled prior to the drive letter change.

    My guess is that due to the DFS Namespace/replication users were still hitting the old drive (G:) and not the new drive with the correct drive letter (T:). But the logs don't show any deletions from DFS.

    Shadow Copies was also enabled on these drives, but when viewing them, they are all the same back to the date that data is msissing from - as though data was never changed.

    Has anything similar happened to you? is there anyway to recover these files if i can no longer connect the drive where these files might have been?

    Tony Mickel


    Tony Mickel

    Tuesday, July 16, 2019 2:04 AM

Answers

  • Did you get a warning like this when the drive letters were changed?


    Cheers, Ben Thomas Microsoft Certified Professional Microsoft MVP Cloud and Datacenter Management Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

    • Marked as answer by kane9522 Wednesday, July 17, 2019 10:23 PM
    Wednesday, July 17, 2019 11:15 AM

All replies

  • Hey Tony,

    Are you able restore the missing files from Veeam?

    DFS-N points to the share, not the drive, so if the share pointed to the new drive after the drive letters where rearranged, then DFS-N would have been sending users to the new disk correctly.

    DFS-R does point to the drive path, however I believe this too would be pointing to the new drive after the letter switch, as I don't believe DFS-R points to drive GUIDs.

    Ben

    Tuesday, July 16, 2019 2:58 AM
  • Unfortunately no, nothing appears to have been put onto the new drive since the drive letter change - hence the change, the old drive wasn't being backed up in the first place.

    Tony Mickel


    Tony Mickel

    Tuesday, July 16, 2019 3:53 AM
  • Sorry but if you deleted the original disk, the new disk doesn't have the data, the shadow copies don't have the data, and you didn't have a backup of it, then you don't have the data anymore.

    If DFS-R was running between the original disk and another server, and that other server had shadow copies enabled, then you might find the data there. Otherwise its a dead end


    Cheers, Ben Thomas Microsoft Certified Professional Microsoft MVP Cloud and Datacenter Management Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

    Tuesday, July 16, 2019 7:15 AM
  • That's what I figured.

    Do you have any light to shed on why the files didn't go to the new drive with the correct share name and DFS Namespace entry?

    Tony Mickel


    Tony Mickel

    Tuesday, July 16, 2019 7:31 AM
  • Did you get a warning like this when the drive letters were changed?


    Cheers, Ben Thomas Microsoft Certified Professional Microsoft MVP Cloud and Datacenter Management Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

    • Marked as answer by kane9522 Wednesday, July 17, 2019 10:23 PM
    Wednesday, July 17, 2019 11:15 AM
  • That looks mighty familiar...not that I remember reading the entire message.

    But it would also explain why files were still going to the old share.

    Tony Mickel


    Tony Mickel

    Wednesday, July 17, 2019 10:23 PM