0

I've got a weird situation occurring on my dev server. Randomly, and for no reason that I can see, files are being rolled back to an earlier version! This has happened twice now - the first time I assumed I'd done something wrong somewhere, restored the file I was after from a backup and gave it no further thought. The second time, just now, it happened to a folder containing just a few files that I was working on - suddenly all the changes I'd made over the last day or two were gone! (I know, commit more often, ay?). Thankfully I have a daily backup and so have recovered my files, but I'm very concerned about this and need to understand how and why it's happened.

The only change made between file states is that I enabled sharing on a completely unrelated folder. I'm developing an app on Railo, which is running on Tomcat. The code was all fine and in c:\websites\appname. I shared the 'Railo' folder, which is c:\railo in order to allow my IDE access to the logs generated by the app (contained in c:\railo\tomcat\logs) and when I reloaded the app, the code was reverted to a few days ago!

I'm at a complete loss here. Can anyone point me in the right direction?

Thanks.

Gary
  • 103
  • 1
  • 3

2 Answers2

1

Could someone else be doing this? You've said you've shared the folder. Turn on auditing on those files and see if someone's dicking with it.

Even restoring a system restore point shouldn't be impacting user data, as they are non-system files.

mfinni
  • 35,711
  • 3
  • 50
  • 86
  • No, I'm the only person with access to the network - I was just sharing between the dev server and my dev own machine. Even if this were the case, it happened in a matter of seconds! – Gary Apr 24 '12 at 15:56
  • Do you have any scripts or scheduled tasks that could be doing this? There isn't any built-in Windows behavior (that I'm aware of) that would ever use VSS to rollback a user file, and VSS is the only functionality that the OS could use to even do this. If you can't find it on your own, use auditing. – mfinni Apr 24 '12 at 15:59
  • I don't have any scripts or such running on the server - in fact it's a new install only about a week old with very few services running on it. Where would I find auditing options? – Gary Apr 24 '12 at 17:06
  • GPO or local security policy, to enable auditing. Then, right-click on the folder(s) that contain the files you're concerned about, go to the Security tab, click Advanced, and go to the Auditing tab. Add the user(s) whose actions are to be audited. The "Everyone" group in the local system might be the best choice here. – mfinni Apr 24 '12 at 17:39
  • I've enabled it now so will keep an eye out. I Looked at the event viewer and I can see a VSS entry about that time... Not sure what it means though. – Gary Apr 24 '12 at 18:01
0

I agree with the other answers about enabling auditing and reviewing the logs. Another helpful tool is to enable previous versions on the folder using shadow copies and set it to create a shadow copy once an hour or so. This way you can revert back to a previous version if needed at any time. It is a really easy way to undo that accidental click/delete/overwrite/moment of forgetfulness.

MikeAWood
  • 2,566
  • 1
  • 12
  • 13