*Urgent* - data recovery question

[seedubya]

Hi all,

a customer called me today. His POS database (.mdb) disappeared from the shared drive on his server about midnight last night. The server spontaneously rebooted following a suspected lightning strike on his incoming wireless broadband antenna which was connected to a cisco router and thence to his server. The server appears fine other than having lost his database, which was open at the time. The most recent backup he h.as is a couple of weeks old. The shared drive in question is on his D:\ partition. I have installed GDB on his C:\ drive and scanned D:\ but can see no evidence of the file in question. The server has been disconnected from the network and nothing else is writing to that partition. Does anyone have any idea what I can do to further attempt recovery of the missing file?

Edit: would be quite willing to pay for assistance, remote access to server available. Can phone anyone etc. This really is ultra important.

 

[Simmy]

Have you checked the temp folders for any autosave copies of the database?

PM sent too.

 

[Mr I]

If the used deleted from the server he has some alternatives, but if it was deleted from a remote computer accessed to the shared folder there's nothing you can do. You can suggest him to backup his data more often

 

[Simmy]

If the used deleted from the server he has some alternatives, but if it was deleted from a remote computer accessed to the shared folder there's nothing you can do.

Why would that make a difference?

 

[Mr I]

Why would that make a difference?

if the file is deleted from the server it goes to the recycle bin but if it is deleted from a remote connection it doesn't go to the server's recycle bin, nor to the that computer's recycle bin.

 

[LunchBox]

How you looked at shadow copies to see if it shows up?

I've never had problems with GBD, I tend to believe that if it is not there it was never there. I had a user once do something similar later I found the file in a different computer.

 

[AtYourService]

if the file is deleted from the server it goes to the recycle bin but if it is deleted from a remote connection it doesn't go to the server's recycle bin, nor to the that computer's recycle bin.

its still got to be on one of the disks regardless

 

[seedubya]

its still got to be on one of the disks regardless

Agreed, but GDB doesn't see it at all. Like it was never there.

 

[MrUnknown]

I believe that GDB works on file markers (first few bytes to act as a signature) when the MFT says the file is no longer there. If GDB doesn't know the marker that says a file is starting here, then it can't see it as being different from random data.

someone feel free to correct me if I am wrong.

 

[frostbyte5014]

Try Easy Recovery Pro. Use the Raw format and specify the database extension. It should recover several preceding versions.

 

[seedubya]

Update: the data loss was caused by someone deciding to "compact & repair" the DB while it was open from multiple locations. Access c&r procedure seems rather dangerous to me, I'm not surprised it could lead to data loss when combined with user stupidity.

@Simmy - no sign of any relevant temp files
@Mr I - it definitely didn't go anywhere near any recycle bin.
@Lunchbox - shadow copies disabled
@frostbyte5014 - thanks for the tip, downloaded and running at the moment. It'll take an age to complete but has already found over 3000 files with the .mdb extension (theres only about 30Gb of 750 used so lots empty space for un-overwritten deleted files - I hope)

Guy's, y'really are the best bunch ever.

 

[Galdorf]

Well if you were looking for files i find that digital rescue premium is good for quick recovery it's super easy to use and cheap.

http://www.dtransfer.com/products/data-recovery/digital-rescue-premium/

I have tried quite a few other software other software seems to take forever this one seems much faster.

On another note do they have a backup system in place if not you should look into setting one up to prevent stuff like this from happening again just back up critical files each day after closing.

 

[kdyer]

While not free, the company that produces Drive Image XML has a great product that you can get data back on: www.runtime.org/data-recovery-software.htm and is called "GetDataBack" I used it on a drive that had Darik's Boot and Nuke run on it and was able to get the data back...

HTH,

Kent

 

[seedubya]

Thanks for GDB kdyer. I already own and use both NTFS and FAT versions on a very regular basis. If you'd read my post you'd see it was the first thing I tried

Data rescue premium didn't see anything. TBH, this program seems very basic. As for backing up, they have been but ran into problems a couple of months ago but didn't call me (misguided cost saving exercise apparently)

While the ontrack software has found many, many files which it has christened .mdb I'm beginning to doubt that they actually are. No Access repair tool that I have access to can even recognise them as database files.

 

[Galdorf]

Seems you need to do low level file reconstruction have you tried r-studio, or recover my files?.

 

[seedubya]

Am currently downloading R-Studio and I'll check out recover my files. They do RAW file recovery I take it?

 

[Galdorf]

Am currently downloading R-Studio and I'll check out recover my files. They do RAW file recovery I take it?

r-studio does all kinds of data recovery and yes it can scan for mdb files.

Other software that can do this restorer ultimate http://www.restorer-ultimate.com/

 

[JRDtechnet]

Any luck yet or is it still scanning? It's strange since if the file was deleted it would of been recovered in 2mins using quickscan with GDB or Recuva. I would investigate what that compact and repair does exactly. Try it on the older database (make a copy obviously and on a different computer) and run process monitor, also try to monitor all the temp folders to see if any new files are created during the process. If it does create a temp file perhaps you can recover the temp file on the computer with the missing data.

 

[MrUnknown]

I think when you edit a file, it is written into the same space so long as the edited file is the same size or smaller. I doubt everytime you save a file it is re-written to an entirely different location.

When it was compacted, it was probably saved over itself.

 

[seedubya]

I think when you edit a file, it is written into the same space so long as the edited file is the same size or smaller. I doubt everytime you save a file it is re-written to an entirely different location.

When it was compacted, it was probably saved over itself.

Agreed, unfortunately. I don't think anything good will come of this. However, it has since come to light that "compact & repair" was NOT run, however the file is still missing. I'm just coming to an understanding of what's involved here. From what I have read I believe all of the information is still on the drive. Nothing has been written to it since so there shouldn't be any problem there. The next issue, then is locating the file. A couple of things come to light here i.e. there doesn't seem to be an entry for the file in the MFT, otherwise GDB would have found the file; also the file is likely heavily fragmented since it's a constantly growing database thus making RAW file recovery precarious. Ideally I would be able to go back to a previous version of the MFT and use that to identify the sectors where the database lives and copy those sectors to new media and stitch them back together.

Anyone have any ideas for achieving the above?