recovery of files from network share

[ecosse]

Big of fat fingers. Deleted files from a network share - blew a way a couple of TB.

Not the end of the world but any advice on how to get data back from it? Its out of the server - it was just a USB drive mounted in windows with a simple share. The s/w I have used so far shows the files but the allocation table is screwy - file headers are zero bytes.

 

[Evan]

First thing is to make a full disk image of the USB drive then start using recover tools only on the copy. Since you have already tried some tools you may be out of luck (which if you just deleted, realized and did nothing else I am a little surprised your software used didn’t manage to get it back so maybe out of luck.)

maybe consider a commercial recovery service if the disk is not yet touched from your attempts if it’s worth the cost.

 

[SRussell]

Hopefully you took the disk offline fairly quickly and did no writes to the disk.

Something like EaseUS Data Recovery should be able to pull the data back.

If you are on Linux testdisk should be able to pull back up the file location pointers.

As @Evan posted do make a block level copy of the disk before you do anything.

 

[dandanio]

[...] how to get data back [...]

Simple! Just restore from the most recent backup!

There are 2 kinds of people in this world: those who do backups and those who will.

 

[dandanio]

Big of fat fingers. Deleted files from a network share - blew a way a couple of TB.

Not the end of the world but any advice on how to get data back from it? Its out of the server - it was just a USB drive mounted in windows with a simple share. The s/w I have used so far shows the files but the allocation table is screwy - file headers are zero bytes.

Do a 1:1 bit-level copy from a source drive and put it on the shelf. Then use Recuva? EaseUS? anything else you want. When it is time to send the drive for a professional repair, do the same.

 

[Evan]

Simple! Just restore from the most recent backup!

There are 2 kinds of people in this world: those who do backups and those who will.

haha well... as your small text says.
I just assumed that was redundant advice and assumed it will be now done in future.

 

[ecosse]

Thanks for the advice everyone. Yeah I yanked it out quick. What I don't understand is from a technical viewpoint why deleting a file from a drive formatted with NTFS shared across the network is any different from a file deleted from the drive locally mounted. It seems to be. Recuva sees the files, but the hex dump of the recovered files is a whole heap of zeros.

SRussell - thanks, got photorec running now.

As for the backup... it hadn't hit my snapraid setup. Its recoverable, just a pain. Too much file data to do out of band backups at every stage - home budget economic reality.

 

[elag]

Thanks for the advice everyone. Yeah I yanked it out quick. What I don't understand is from a technical viewpoint why deleting a file from a drive formatted with NTFS shared across the network is any different from a file deleted from the drive locally mounted. It seems to be. Recuva sees the files, but the hex dump of the recovered files is a whole heap of zeros.

SRussell - thanks, got photorec running now.

As for the backup... it hadn't hit my snapraid setup. Its recoverable, just a pain. Too much file data to do out of band backups at every stage - home budget economic reality.

Wat this a harddisk or an SSD? if the latter, TRIM may have freed the sectors and replaced the by zeroes....

 

[ecosse]

Wat this a harddisk or an SSD? if the latter, TRIM may have freed the sectors and replaced the by zeroes....

Thanks and good shout but no, spinning rust - 6TB seagate USB drive of some description.