Windows 2000 server, Bad security Practice, User overwrote folder... Please Help!

  • Thread starter Thread starter jtstockton
  • Start date Start date
J

jtstockton

Hello all,
I am in need of someone's help, I have a brother who works for a
company in Hawaii, they have a windows 2000 server, Apparently the 3rd
party company that set up the server, did not setup a good policy, one
of the users overwrote one of their folders, they do not have a good
back up in place( Last back up was 3 months ago... ya) Is there any way
to retrieve the old folder? Not to familiar with the system, me being
in Idaho and them in Hawaii. Any help would be appreciated.

Thanks
Justin Stockton
 
Hello all,
I am in need of someone's help, I have a brother who works for a
company in Hawaii, they have a windows 2000 server, Apparently the 3rd
party company that set up the server, did not setup a good policy, one
of the users overwrote one of their folders, they do not have a good
back up in place( Last back up was 3 months ago... ya) Is there any way
to retrieve the old folder? Not to familiar with the system, me being
in Idaho and them in Hawaii. Any help would be appreciated.

Thanks
Justin Stockton
Click to expand...

They could TRY a data recovery program. But if this is a busy server,
and it's been a while, the folder is probably toast. The word
"overwrote" is ominous. It MAY be possible to recover data that has
been overwritten, but the price goes WAY up, as only few companies have
the specialized equipment to (1) dissasemble the hard drive and remove
the platters without hurting them (OK so the requirements are a small
torx screwdriver and a clean room) (2) read the read the platters and
look for magnetic "shadows" between the tracks and (3) get back more
than fragments of files. The FBI can do this, but only if the
information is important to a high profile criminal case.

You should make a forensic quality disk image first.

HOWEVER if the system was defragged shortly before the overwriting
occurred, it is possible that some data may be recoverable. It may also
possible to reconstruct the contents of that folder (if on the server)
by cheking the hard drives of all the client machines that had access
to it if the machines opened the files in memory, some of the bits may
have wound up in a page file. You will then have to peice them together
from various sources. Lot of work here. And the chance of sucess goes
down with each minute that the client machines have been in use.

Best of luck. You'll need it.
 
Ya that's what I thought... My Guess is it has not been defragged,
Especially since the last back up was 3 months ago, It doesn't look
like server maintenance was on the big list of important things to do.


Thanks For the input

Justin Stockton
 
Back
Top