-2

We currently use MozyPro for our online backups but in order to save on the amount of storage space we need to purchase with them we opted to move a large number of images over the SharePoint storage space we get as part of Office 365.

One of the folders we tried to move, which contained more than 10000 very important image files (nested with further folders), errored saying that one or more of the files within were currently in use. Only two of us have access to this directory and neither of us were using any of the files, but we thought it best to leave it until the next morning in case antivirus was running or MozyPro was backing up the files.

Upon returning the next day however the folder has now entirely disappeared. It is not in the original directory we wanted to move it from, and it is not in the directory we attempted to move it to. It has not been backed up by MozyPro and very strangely the folder does not exist in the shadow copies we run 4x daily.

We are only a small office of 10 staff (I'm the IT guy) and none of the other staff have the technical knowledge to be able to grant themselves access to the folder. I very highly doubt one of us has accidentally deleted the folder, let alone somehow a hard delete which has made the folder disappear from shadow copies as well.

I have tried a number of recovery tools but none of them can find anything that was stored in that directory. We have only been able to salvage a few photos from the SD card in the camera used to take the pictures by using a data recovery tool.

Can anyone offer any suggestions as to what may have happened here?

Manno
  • 97
  • [SysInternals Handle](https://technet.microsoft.com/en-us/sysinternals/handle.aspx) should identify what is accessing the file/folder. Otherwise you'll need to comb through the event logs to identify what happened. – user2320464 Sep 21 '16 at 04:39

1 Answers1

0

Take the volume offline and use testdisk to browse a backup MFT to grab corrupt directories and deleted files, or use scrounge-ntfs to dump every file that was ever on there to another disk.

You may have run into a filesystem corruption (hence the "in use" message, which might not have even been true). Alternatively, you may have run into a very unfortunate move bug. Either way, testdisk really should be able to find old MFT records and "undelete" that directory entry.

It's hard to say exactly if it will work, because I don't have the filesystem in front of me to see what may have caused it. Not to mention, NTFS is super mysterious, and what we know about it is reverse-engineered (albeit fairly completely).

Spooler
  • 7,016
  • 16
  • 29