Quick rundown - We have a NAS at work. There is a folder (with subfolders) somewhere on the NAS, the contents of which for some reason disappeared. No-one remembers moving or deleting the files, they just don't show up. We're assuming (for the moment) that the files were just ordinarily deleted by someone somehow. It's an NTFS filesystem for those wondering.
Here's my question - assuming that the files were deleted in the sense that the addresses associated with the files were erased, but the physical data is still on the sectors, is there a program somewhere that can scan the sectors associated with those folders and subfolders to see if the files are still there? Perhaps that isn't how filesystems work, but if there's something like dd that can scan unassigned sectors of the drive to look for files, that's what I need.
How many drives and in what RAID configuration? If it's a single drive or a RAID1 array, you can take the (or "a") drive out, plug it into a PC and run Recuva. Unfortunately Recuva doesn't work over a network, or at least I don't think so. It certainly won't scan my own Freenas NAS, but then again that's running ZFS rather than NTFS.
Make sure you restore any files to another physical drive, be it a usb stick or an external HDD/SSD. Whatever you do, DON'T restore the files to the original drive because during the recovery the files are basically written again in any location that the filesystem deems appropriate. You may end up overwriting files that still need to be recovered.
Now would be a good time to convince your boss that he needs to invest in a backup solution.
It's a single-drive NAS solution (which, believe me, I know, is completely asinine and ridiculous for a business) so what will probably end up happening, is I'll pull the drive, mount it and run Recuva/Photorec/TestDisk on it.
Thanks for you guys' help! Keep suggestions coming because this may not work :DDDD
You're going to want to stop using it until you do the recovery. If the files were deleted or the metadata corrupted or whatever then the actual data will be easy enough to recover, but if you keep using the disk you risk overwriting it.
If you think that the disk is going bad then I would suggest making an image of the disk (using dd or dd rescue, or whatever) and running your recovery software on the image. That way you won't cause any further damage to the disk.
Might be a decent time to build a backup server and play with FreeNAS 10 BETA... :') Also, ZFS snapshots would be nice about now, if that can be a thing in the future.
Definitely what @Dexter_Kane said, image it and work on that. Hope you make some progress on it. Just to cover all bases, no custom CRON jobs running or anything? Did you verify that the files were gone from the command line?
My coworker's husband's a network engineer, and he just about had an aneurysm when he came to visit the office one day and saw the situation with the network and the NAS. The technological aspect of the company probably gave him PTSD.
I'll see what I can do but convincing the boss to move to SSDs was long and arduous enough... Even after this he opted to just start the project from the beginning. Granted, it took all of a few hours, but if you know the story behind the SSDs, you know how stubborn he is. The company has already had one catastrophic hard drive failure, and we have no form of backup, no form of redundancy and the NAS enclosure he uses has Lenovo's proprietary linux-based firmware on it which makes running checks on the drive next to impossibru. He'll spend $200 on getting a machine with an i7 he doesn't need vs. an i3, but he won't spend $200 on a proper storage server. It just... the mind reels, it really does.
Thanks for all your help, guys! sorry this topic just sort of quietly and abruptly died... but I'm grateful for what you've suggested to me :D I'll implement it down the road!
The only way idiots like your boss understand the errors of their ways is if you attach a dollar value to the problem. Track your time spent working on this. Also make sure to note when people talk about not having access to the files on the NAS. What got held up? Internal projects? Sales projects? That sort of thing. And of course, if you do recover the files, make sure to stress how touch-and-go this whole process was, and how for most of the time, simply not being able to retrieve the files was a very real possibility.
Also try to be ready with a quote for a white box FreeNAS machine (assuming you're a FreeNAS kinda person). FreeNAS runs very well on commodity hardware, and the price tag for such a machine tends to come as a rather happy surprise to managers who have seen the price tag of other NAS solutions, or the price tag for sending drives off to companies like Kroll OnTrack, which can easily run them $10,000.
Another good point to bring would be the cost of a drive failure, what would be the cost of that one NTFS drive failing? Because it's probably not if, but when.
