I have had a colleauge of mine delete some files from a shared network drive and she really needs to get them back. I tried searching for them but I could not find anything.
What happens to a file on a network drive when it is deleted?
I know there may be many variables which might affect what happens, but what kind of things could we be looking at?
A lot of it depends on what kind of server the shared drive resides upon; if it’s a Novell netware server, for example, the files can probably be retrieved (in much the same way that the old Undelete command used to work back in DOS, This would have to be done by the administrator. Best bet is it contact your system administrator as soon as possible; if the files can’t be retrieved on the server natively, they are quite probably backed up somewhere, but the backup may be a rolling 7-day set or something like that, in which case the backup containing the files would be overwritten a week later.
Contact the administrator, bribe with beer or chocolate if necessary.
Okay, well, this isn’t really my specialty, but I’ll provide what info I can from a little experience with windows networks.
windows recycle bin support is limited to local hard drives, not network drives. I imagine what happens is something very close to an old DOS-style delete - clusters on the hard drive are deallocated and the directory entry is marked with some sort of simple flag to indicate ‘this entry has been deleted.’ Most of the info is probably still there on the hard drive, depending on activity on that drive since, (OS designers abhor wasted effort - no point in physically erasing data before the space it’s occupying needs to be used for some other file.) However, you’ll need to find some kind of low-level ‘undelete’ capable of working on that disk, and you’ll probably need to run it from the computer hosting the network drive - either physically sit down on it or use some kind of remote desktop program
Sorry I couldn’t provide more specific tips. Hope you find what you need to know.
on preview: hi mange.
The others are basically right. If you are talking about a Windows server, those files are gone. In some cases, you might be able to run some recovery utility and recovery it off of the machine but you need access to the machine itself and have some degree of luck. If the files are extremely important, then ask back for more specific advice. If they are replaceable at all, then kiss them goodbye and tell him to use that as a lesson in doing multiple backups.
I have actually sent something on to see if we can get the files recovered. The user said that she worked on the file for 3 hours and then deleted instead of copying it.
I don’t know how network shares work when you delete something off them so I wanted to see if you guys had any thoughts or info.
Thanks for the answers, guys. I’ll see where I get with the sys admins.
When you talk to the admins, tell them the date when the file was last known to be there (unfortunately the last backed up version won’t have the 3 hours work that your colleague put in on it). You need to get the files off the backup before they re-use the media; obviously stressing the urgency of the matter doesn’t always help and can in fact irritate the admin and make him put off the job.
If it were me, I’d be saying that I understand their workload, so please could they set aside that backup media, so that the recovery job doesn’t necessarily have to be treated as top priority.