Server files gone!

[Byteman]

I have a small server issue I thought I'd throw out here for any ideas...

Situation: we have tens of thousands of files (mainly word processing docs),
on our 2003 file/print server. Now seemly random files are gone! I can't
figure out why!?....
I did notice that when I use vss for files to get these missing files back,
that they all seem to be missing after Sep.24th 12pm (my afternoon vss
snapshot). So something has happened that evening, (on the 25th at 7am I
have another snapshot taken and the files are not there).

Variables: Using NTBackup to VS-80 tape drive, Acronis TrueImage Server 9.1
creating differential images nightly to an external USB HD. I verified that
neither backup routine crosses over each other (time wise). The image for
that night finished with no errors, but the backup died during the backup of
the system state, (however all our files and such finished their backup)

Question: At first I chalked it up to users deleting files, but now I'm not so
sure... has anyone heard of this before, or have any thoughts/suggestions?
Thanks...
Byteman

 

[apj101]

That sounds pretty random mate. Were all the files gone? Have you rolled back to the Sep.24th 12pm image?
are those files restricted across the network or can any terminal delete them. If it happened overnight do you have any user logs to check, i recall you are running an AD, do you have the AD auditing logs setup.
Sorry for the vague answers but its a pretty vague problem

 

[Byteman]

everyone has full access as they are attorneys/secretaries usually creating/modifying,etc.. the same case files, but only some files and they seem to be randomly deleted, however it's getting to the point where i can't be a simple mistake, (now about a dozen different files from different directories, and all are retrievable from the 24th vss snapshot, not after). It hasn't happened since (that I know of), so enabling auditing wouldn't do much at this point, (and even so, I'd have to enable it in AD then configure each individual folder for it... I've got 1000's...). I've looked at all the Windows logs, Acronis logs, and NTBackup logs for that day and the day after,... no errors except for the NTbackup.

 

[apj101]

everyone has full access as they are attorneys/secretaries usually creating/modifying,etc.. the same case files, but only some files and they seem to be randomly deleted, however it's getting to the point where i can't be a simple mistake, (now about a dozen different files from different directories, and all are retrievable from the 24th vss snapshot, not after). It hasn't happened since (that I know of), so enabling auditing wouldn't do much at this point, (and even so, I'd have to enable it in AD then configure each individual folder for it... I've got 1000's...). I've looked at all the Windows logs, Acronis logs, and NTBackup logs for that day and the day after,... no errors except for the NTbackup.

well mate it a mystery. Just roll back to the last decent image, and see if it repreats itself.
Other than turning on the auditing you may not know who or under who's credentials the files were removed.

 

[Byteman]

yah, I thought so too, microsoft agrees as well as others... it's my employers I have to convince now, they believe no one in the company would delete files like that and not say anything... go figure.
Thanks much,
TC