none
Recover offline files from the local cache RRS feed

  • Question

  • hopefully this is the forum for this issue as i couldn't find a clear fit as to where to place it.

    I have a Windows XP client where the user, being ignorant of such things, was working offline for quite a while. months apparently.

    The user amassed quite a few documents in their My Documents folder, all offline.

    In this Active Directory based network the path to the Documents folder is abstracted via a domain DFS namespace.

    The server that originally held all the users' My Documents folders was eventually decommissioned after all the files were replicated to another file server while maintaining the same DFS namespace path.

    this user continued working even though they were offline and one bright morning they logged on and they couldn't find their files anymore.

    when the offline files folder is opened you can see the user's files listed and they show as either "only local copy exists" or as "local copy data has been modified"

    Trying to restore these files by copying them out of the offline files folder results in an error stating that: "Can't read from source file or disk."

    is there any way that these files that seem to exist only in the local offline files cache to be recovered?

    thanks in advance!


    Ted S. Antonakis
    Friday, June 19, 2009 11:55 AM

Answers

  • Hello TedSA,

     

    Thank you for posting here.

     

    Generally speaking, if the offline file database is still there, you may consider using the /extract option of the CSCCMD command to extract files from offline file database to recover it.

     

    Features and functions in version 1.1 of the Client-Side Caching Command-Line Options command-line tool

    http://support.microsoft.com/kb/884739

     

    For your reference, here is the directions which describes how to use csccmd /extract to extract a copy of a CSC cache that you obtained from another machine. The directions apply to CSC in Windows 2000, Windows XP, and Windows 2003.

     

    Because csccmd.exe /extract only extracts the active cache on the local machine, you will need to configure CSC to use the cache copy you want to extract, do the extraction, and the have CSC point back at its original cache location. The directions below describe how to do that.

     

    1. First, copy the contents of the CSC directory from the a location on HD to the local machine. Make sure to copy everything, including hidden/system files. The easiest way to do this is by dragging the whole folder over. You will be working a copy of the cache. Do not skip this step. This should include the files 00000001, 00000002, 00000003, and perhaps 00000004 in the top-level CSC directory as well as directories d1 through d8 and their files.

     

    2. Second, find the DatabaseLocation value under the registry key

     

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache. You can look this up using this command (from the command line):

     

    reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache /v

     

    DatabaseLocation

     

    Write down the entire output.

     

    If the value is not found, note that fact. This is because you are going to change this setting to point to the cache location to point to the files you want to extract, and you will want to change this setting back once you are done.

     

    For example, if the below were the output, you would write down the part in bold.

     

    Note that the registry value type in the example below is REG_SZ and the cache location is C:\Example\CSC

     

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache

     

    DatabaseLocation REG_SZ C:\Example\CSC

     

    On the other hand, if the below were the output, you would write down that the value did not exist:

     

    ERROR: The system was unable to find the specified registry key or value.

     

    3. Now you are ready to change the CSC cache location to point to the copy of the cache that you want to extract. First, you need to disable CSC if it is enabled. To

     

    check whether CSC is enabled, run:

     

    csccmd /isenabled

     

    If CSC is enabled, you need to disable it by by running:

     

    csccmd /disable

     

    4. Next, point the CSC cache location on the local machine to the location where you copied the CSC cache that you want to recover. You do this by specifying the cache location for the DatabaseLocation value under the registry key

     

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache. You can do this from the command line:

     

    reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache /v

     

    DatabaseLocation /t REG_SZ /d "CacheLocation"

     

    For example,

     

    reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache /v

     

    DatabaseLocation /t REG_SZ /d "C:\CopiedCscCache"

     

    5. Before re-enabling CSC to point to the copy of the cache you want to extract, you may want to disconnect from the network if you want to make sure that CSC does not try synchronize the copy of the cache. You can do this by disabling all of your

     

    network interfaces or physically disconnecting from the network. (If you are using wireless, you need to disable the relevant network interface.)

     

    6. Re-enable CSC using the following command:

     

    csccmd /enable

     

    7. Make sure that CSC is finding the cache you expect by having it enumerate the list of cached shares:

     

    csccmd /enum

     

    8. Do the cache extraction per KB article 884739

     

    The command will be something like this:

     

    csccmd /extract /target:PathWhereToPutExtractedFiles /recurse

     

    9. Once you are done extracting the desired files, you can set the cache location back to what it was by disabling CSC, changing the cache location in the registry, and re-enabling CSC (if it was enabled in the first place).

     

    First, disable CSC:

     

    csccmd /disable

     

    Next, change the cache location back to what it was. If there was no cache location specified, use this command:

     

    reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache

    /v DatabaseLocation

     

    If there was one, use this command below, substituting the registry value type and cache location value recorded in step 4 above.

     

    reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache /v

     

    DatabaseLocation /t REG_SZ /d "OldCacheLocation"

     

    Finally, if CSC was enabled when you started out (in step 3), re-enable it:csccmd /enable

     

    Please note:

     

    If the above method doesn’t work, you may try the following methods to try to recover them manually

     

    1. The offline files are cached in directories located "%systemroot"/CSC/%, and these directories are labeled d1,d2,d3, .... You can locate to your file by the files data/time stamp and size. If you copy the file to a temporary location and rename it to the name and extension needed you will be able to open it.

     

    2. Please use the following article to search the CSC cache to find documents with no/unknown file extensions

     

    309173 Using the "A word or phrase in the file" search criterion may not work

    http://support.microsoft.com/?id=309173

     

    When the documents are recovered, you may use the following article to reset the CSC cache:

     

    230738 How to Restart the Offline Files Cache/Database

    http://support.microsoft.com/?id=230738

     

    Hope the information can be helpful.


    This posting is provided "AS IS" with no warranties, and confers no rights.
    • Marked as answer by TedSA Tuesday, June 23, 2009 3:57 PM
    Monday, June 22, 2009 11:01 AM

All replies

  • Have you tried going into the C:\Windows\CSC and hunting them down. You'll have to fight through ugly restrictive permissions that prevent you from doing it but with a bit of persistance you can steadily take ownership of each directory down the tree or do it with something like the TakeOwn command from one of the reskits. Then once you have busted your way into the CSC directory hierarchy all the users files should be there.

    Or better yet go download SystemRescue CD from http://www.sysresccd.org/Main_Page and then fire it up mount the NTFS drive the files live on and copy them out of the CSC directory tree where they live and onto your server where they should live.

    I had a problem like this on my own Vista laptop where I offline files only half way turned off and had to do the long permission reset method to get my files back. I just thought of the easier SystemRescue CD method that would be easier because a Linux bootdisk that can mount NTFS partitions doesn't care about NTFS file security :)

    Hope it works for you.
    Gary
    Friday, June 19, 2009 4:14 PM
  • thanks for the suggestions.

    the client is a windows xp machine.

    The folder structure under c:\windows\csc subfolder is actually very simple and i didn't have much issue with permissions.

    but the files there are un-recognizable.

    the folders are named d1, d2, d3, etc. there is only level of folders.

    within each of these folders are a bunch of files that explorer classifies them as system files even though they don't have an extension and they are between 1K and 3K in size.

    these are followed by files that have ascending numbers for a name, also without an extension, but explorer doesn't classify them as system files, just files, and these have a variety of sizes.

    my assumption would be that these are the actual files, but piecing them together and connecting them to their names and extension would be a major undertaking.

    any other ideas? anyone?
    Ted S. Antonakis
    Friday, June 19, 2009 4:34 PM
  • Hello TedSA,

     

    Thank you for posting here.

     

    Generally speaking, if the offline file database is still there, you may consider using the /extract option of the CSCCMD command to extract files from offline file database to recover it.

     

    Features and functions in version 1.1 of the Client-Side Caching Command-Line Options command-line tool

    http://support.microsoft.com/kb/884739

     

    For your reference, here is the directions which describes how to use csccmd /extract to extract a copy of a CSC cache that you obtained from another machine. The directions apply to CSC in Windows 2000, Windows XP, and Windows 2003.

     

    Because csccmd.exe /extract only extracts the active cache on the local machine, you will need to configure CSC to use the cache copy you want to extract, do the extraction, and the have CSC point back at its original cache location. The directions below describe how to do that.

     

    1. First, copy the contents of the CSC directory from the a location on HD to the local machine. Make sure to copy everything, including hidden/system files. The easiest way to do this is by dragging the whole folder over. You will be working a copy of the cache. Do not skip this step. This should include the files 00000001, 00000002, 00000003, and perhaps 00000004 in the top-level CSC directory as well as directories d1 through d8 and their files.

     

    2. Second, find the DatabaseLocation value under the registry key

     

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache. You can look this up using this command (from the command line):

     

    reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache /v

     

    DatabaseLocation

     

    Write down the entire output.

     

    If the value is not found, note that fact. This is because you are going to change this setting to point to the cache location to point to the files you want to extract, and you will want to change this setting back once you are done.

     

    For example, if the below were the output, you would write down the part in bold.

     

    Note that the registry value type in the example below is REG_SZ and the cache location is C:\Example\CSC

     

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache

     

    DatabaseLocation REG_SZ C:\Example\CSC

     

    On the other hand, if the below were the output, you would write down that the value did not exist:

     

    ERROR: The system was unable to find the specified registry key or value.

     

    3. Now you are ready to change the CSC cache location to point to the copy of the cache that you want to extract. First, you need to disable CSC if it is enabled. To

     

    check whether CSC is enabled, run:

     

    csccmd /isenabled

     

    If CSC is enabled, you need to disable it by by running:

     

    csccmd /disable

     

    4. Next, point the CSC cache location on the local machine to the location where you copied the CSC cache that you want to recover. You do this by specifying the cache location for the DatabaseLocation value under the registry key

     

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache. You can do this from the command line:

     

    reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache /v

     

    DatabaseLocation /t REG_SZ /d "CacheLocation"

     

    For example,

     

    reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache /v

     

    DatabaseLocation /t REG_SZ /d "C:\CopiedCscCache"

     

    5. Before re-enabling CSC to point to the copy of the cache you want to extract, you may want to disconnect from the network if you want to make sure that CSC does not try synchronize the copy of the cache. You can do this by disabling all of your

     

    network interfaces or physically disconnecting from the network. (If you are using wireless, you need to disable the relevant network interface.)

     

    6. Re-enable CSC using the following command:

     

    csccmd /enable

     

    7. Make sure that CSC is finding the cache you expect by having it enumerate the list of cached shares:

     

    csccmd /enum

     

    8. Do the cache extraction per KB article 884739

     

    The command will be something like this:

     

    csccmd /extract /target:PathWhereToPutExtractedFiles /recurse

     

    9. Once you are done extracting the desired files, you can set the cache location back to what it was by disabling CSC, changing the cache location in the registry, and re-enabling CSC (if it was enabled in the first place).

     

    First, disable CSC:

     

    csccmd /disable

     

    Next, change the cache location back to what it was. If there was no cache location specified, use this command:

     

    reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache

    /v DatabaseLocation

     

    If there was one, use this command below, substituting the registry value type and cache location value recorded in step 4 above.

     

    reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache /v

     

    DatabaseLocation /t REG_SZ /d "OldCacheLocation"

     

    Finally, if CSC was enabled when you started out (in step 3), re-enable it:csccmd /enable

     

    Please note:

     

    If the above method doesn’t work, you may try the following methods to try to recover them manually

     

    1. The offline files are cached in directories located "%systemroot"/CSC/%, and these directories are labeled d1,d2,d3, .... You can locate to your file by the files data/time stamp and size. If you copy the file to a temporary location and rename it to the name and extension needed you will be able to open it.

     

    2. Please use the following article to search the CSC cache to find documents with no/unknown file extensions

     

    309173 Using the "A word or phrase in the file" search criterion may not work

    http://support.microsoft.com/?id=309173

     

    When the documents are recovered, you may use the following article to reset the CSC cache:

     

    230738 How to Restart the Offline Files Cache/Database

    http://support.microsoft.com/?id=230738

     

    Hope the information can be helpful.


    This posting is provided "AS IS" with no warranties, and confers no rights.
    • Marked as answer by TedSA Tuesday, June 23, 2009 3:57 PM
    Monday, June 22, 2009 11:01 AM
  • this did the trick.

    i had a bit of difficulty getting a prompt reply from ms support services about getting access to the csccmd version 1.1 but i was able to find it elsewhere.


    many thanks!


    Ted S. Antonakis
    Tuesday, June 23, 2009 4:00 PM
  • Hello TedSA,

     

    Thank you for the feedback.

     

    I'm glad to hear that the information could be helpful. If you have any other question, please welcome to the TechNet forum again.


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Wednesday, June 24, 2009 3:01 AM
  • Hi Ted,

    I am currently facing the same problem but on Windows 7 machine.

    Could you be able to help me out in getting CSCCMD tool. It would very kind of you.

    Look forward to hearing from you.

    many thanks.


    om
    Friday, January 14, 2011 1:18 PM
  • Hi Gary,

    I have downloaded the System Rescue CD ... is that fairly easy to use with windows 7.....

    appreciate your feedback...

    thanks,

    om


    om
    Friday, January 14, 2011 1:39 PM
  • 2 years after the fact & this post saved me a bunch of pain. Thanks a million!
    Wednesday, May 4, 2011 3:33 PM
  • Thank you for your post I have been hunting around on the web trying to recover offline files for a few days now! :o) Everything seems to be going the right direction apart from one problem offline encryption.

    Little background, windows xp sp3 laptop which refuses to switch on (think the motherboard has died) taken the hard drive out placed it in a cradle can read all the data not a problem.

    Have followed the CSC steps but after checking the CSC folder I have copied off the drive, the new folder on a different laptop doesn't show the same folder contents.

    Have located the file I require on the original but when trying to copy it out I am getting a access denied error. Is there anyway to copy the CSC files from an encrypted offline folder? (CSC)

    Any help would be great! :)

    Brad

    Thursday, September 29, 2011 8:35 AM
  •  Recover offline files from the local cache : this tool recommended by Microsoft to repair offline files For more details:- http://www.ostrecovery.co.uk
    Friday, March 23, 2012 6:16 AM
  • This was an AWESOME post.  Amazing that to this day, this post corners the market on fixing this problem.  The only problem with it, is where to find the 1.1 Version of CSCCMD.  This guy made it public, even if MS won't.  Thanks for this post!  

    http://www.jacksontechnical.com/pubfiles/csccmd_v1.1.zip 

    Sunday, March 2, 2014 3:41 AM
  • Thank you for this! Still works, even when it shouldn't be relevant anymore. *sigh*

    If only every kb article was written in such a magnificent way, ah...

    Monday, September 15, 2014 1:12 PM