recovery of files from network share

ecosse

Active Member
Jul 2, 2013
373
64
28
Big of fat fingers. Deleted files from a network share - blew a way a couple of TB.

Not the end of the world but any advice on how to get data back from it? Its out of the server - it was just a USB drive mounted in windows with a simple share. The s/w I have used so far shows the files but the allocation table is screwy - file headers are zero bytes.
 

Evan

Well-Known Member
Jan 6, 2016
3,060
512
113
First thing is to make a full disk image of the USB drive then start using recover tools only on the copy. Since you have already tried some tools you may be out of luck (which if you just deleted, realized and did nothing else I am a little surprised your software used didn’t manage to get it back so maybe out of luck.)

maybe consider a commercial recovery service if the disk is not yet touched from your attempts if it’s worth the cost.
 

SRussell

Active Member
Oct 7, 2019
292
147
43
US
Hopefully you took the disk offline fairly quickly and did no writes to the disk.

Something like EaseUS Data Recovery should be able to pull the data back.

If you are on Linux testdisk should be able to pull back up the file location pointers.

As @Evan posted do make a block level copy of the disk before you do anything.
 

dandanio

Active Member
Oct 10, 2017
130
44
28
Big of fat fingers. Deleted files from a network share - blew a way a couple of TB.

Not the end of the world but any advice on how to get data back from it? Its out of the server - it was just a USB drive mounted in windows with a simple share. The s/w I have used so far shows the files but the allocation table is screwy - file headers are zero bytes.
Do a 1:1 bit-level copy from a source drive and put it on the shelf. Then use Recuva? EaseUS? anything else you want. When it is time to send the drive for a professional repair, do the same.
 

Evan

Well-Known Member
Jan 6, 2016
3,060
512
113
Simple! Just restore from the most recent backup!

There are 2 kinds of people in this world: those who do backups and those who will.
haha well... as your small text says.
I just assumed that was redundant advice and assumed it will be now done in future.
 

ecosse

Active Member
Jul 2, 2013
373
64
28
Thanks for the advice everyone. Yeah I yanked it out quick. What I don't understand is from a technical viewpoint why deleting a file from a drive formatted with NTFS shared across the network is any different from a file deleted from the drive locally mounted. It seems to be. Recuva sees the files, but the hex dump of the recovered files is a whole heap of zeros.

SRussell - thanks, got photorec running now.

As for the backup... it hadn't hit my snapraid setup. Its recoverable, just a pain. Too much file data to do out of band backups at every stage - home budget economic reality.
 

elag

Member
Dec 1, 2018
77
13
8
Thanks for the advice everyone. Yeah I yanked it out quick. What I don't understand is from a technical viewpoint why deleting a file from a drive formatted with NTFS shared across the network is any different from a file deleted from the drive locally mounted. It seems to be. Recuva sees the files, but the hex dump of the recovered files is a whole heap of zeros.

SRussell - thanks, got photorec running now.

As for the backup... it hadn't hit my snapraid setup. Its recoverable, just a pain. Too much file data to do out of band backups at every stage - home budget economic reality.
Wat this a harddisk or an SSD? if the latter, TRIM may have freed the sectors and replaced the by zeroes....
 

ecosse

Active Member
Jul 2, 2013
373
64
28
Wat this a harddisk or an SSD? if the latter, TRIM may have freed the sectors and replaced the by zeroes....
Thanks and good shout but no, spinning rust - 6TB seagate USB drive of some description.