Recovering Deleted Files

Question

Level 1

8 points

Recovering Deleted Files

I have been asked to look after a Mac X server ver 10.4.11 due to a company merger. I am a Windows and networking expert with little knowledge of Macs. Could someone please tell me the procedure to recover files deleted from an SMB share on the server. I have read various Mac manuals and it doesn’t say anywhere I can find. The procedure would be easy on a Windows server so I’m sure it is not difficult on a Mac.

Posted on Sep 29, 2009 5:31 AM

Reply

Answer 1

Sep 29, 2009 1:23 PM in response to tinsoup

What would you do on a Windows Server?

Reply

Answer 2

foilpan

Level 4

1,385 points

Sep 29, 2009 3:49 PM in response to tinsoup

if you're backing up your server, refer to whatever you're using to do so. otherwise, there's no definite way to recover a deleted file. if it's essential and you don't have any backup, you might try a data recovery application on the drive or send it out to a data recovery house.

otherwise, be sure this server gets backed up in some manner.

Reply

Answer 3

tinsoup Author

Level 1

8 points

Oct 1, 2009 4:07 AM in response to Grant Bennet-Alder

Unfortunately I don't have a backup as the files were deleted under the old administration regime as the transfer was taking place and they didn’t maintain viable backups. So I am left to pick up the pieces.

Under Windows there are several ways to retrieve deleted items.

Recycle Bin - This is equivalent to the Mac Trash

Undelete - There is a simple undelete command the will undelete things that have been emptied from the Recycle Bin.

Previous Versions - At regular intervals set by the administrator, say every 30 minutes. The OS takes a snapshot of a volume and stores that as a backup. This happens 24 hrs a day. At any time any user can go back to a previous version of their document or an entire folder e.g. if a document becomes corrupt or if they make a mistake. If a document becomes deleted you simply go back to a previous version of the folder before the document was deleted and select that document. This can overwrite what is there now or you can copy the previous version somewhere else leaving what is there intact.

Reply

Answer 4

Oct 1, 2009 8:22 AM in response to tinsoup

1) recycle Bin -- the Mac does maintain Trash folder S for each user, but I do not think there is one central repository for trashed files. You would have to look through each account. I believe, to make matters more difficult, these folders are marked invisible, and when emptied, the entire contents AND the Trash folder are removed and added to the free blocks map.

2) Undelete -- This feature has been available is third-party software such as Tech Tool Pro and the now-disgraced Norton Utilities. But it depends on clawing back the blocks involved from the free blocks map, provided they have not yet been re-used. It's always been a desperation tool, and never guaranteed.

3) Previous versions -- Backups at regular intervals is available through Time Machine with or without Time Capsule. It may be a solution going forward, but it does not look like it would solve your current situation.

An Industrial Strength tool for making arbitrarily complex custom backup solutions to different media could use Retrospect, now available from emc. If making backups only to other Disk drives, there are a multitude of solutions, some at no cost.

Reply

Answer 5

tinsoup Author

Level 1

8 points

Oct 2, 2009 3:37 AM in response to tinsoup

Going forward we are OK. We have extended our normal backup regime to cover the Mac server. We use Backup Exec to back up our servers and VM’s daily on a tape library. This is stored offsite (if only that was done before). This, as you have pointed out does not help us in this case.

Unfortunately the files that are missing are important so I have to make an attempt to recover them. Can anyone recommend a third party product that they know works and can get data off a SMB share. I have tried a couple of products but it seems that the fact that it is an SMB share has defeated them.

Reply

Answer 6

foilpan

Level 4

1,385 points

Oct 2, 2009 6:41 AM in response to tinsoup

smb share or not, are you talking about deleted data on an os x server hosted disk?

if so, the same rules apply. your next options are to stop writing to the disk, unmount/remove it, and try something like data rescue ( http://www.prosofteng.com/products/data_rescue.php) or some other data recovery app. if those don't work, drivesavers or similar may be your only hope.

it's unix under the hood, so when you delete a file, the blocks are marked free and ready to be overwritten. be sure to test your backups periodically.

Reply

Answer 7

Oct 2, 2009 5:04 PM in response to foilpan

Data Rescue is especially interesting because it is said to refuse to repair a damaged disk "in place". It insists on having a different disk to restore to. Based on that underlying attitude, it may be willing to work harder at "pulling things out of the Trash" than the rest of the disk repair pack.

If the data is on a mirrored RAID, the Apple RAID software allows you to split the RAID and take a drive out for data recovery or backup, then add a new drive in and bring the new drive up to current state while all continues to run.

Reply