Files disappearing off server computer

[OrbitzXT]

In my office we have a small network of computers. There is one server, which has actual server hardware in it though it has Windows 7 on it instead of Windows Server 2008 or anything like that. And then there are about 8 PCs connected via a network switch. A couple of weeks ago, some folders and files were missing. At first I thought maybe someone deleted something by accident but too many things were missing and in random places, so I do not believe human error is the cause here.

So I restored the files and didn't think much of it, but it happened again yesterday. It seems like less files have disappeared this time around, but the ones missing this time seem to be the same ones missing from last time. I also noticed it happened in the middle of the work day, because I made use of one of the folders in the morning and it was missing by afternoon.

I've never really dealt with an issue like this before, and sadly I'm the closest thing we have to an IT guy here. All I can think of is that one of the hard drives is going bad? There's two HDDs in a Raid 1 array I believe. What else could it be?

Before these two incidents, the PC had been problem free for about 1.5 years.

 

[ChristTheGreat]

What is the hardware? (Motherboard, Hard drive)

maybe it's time for a chkdsk to see if there is any bad sector or corruption..

 

[INSTG8R]

Gremlins? Clu? I kid...
Might not be a bad idea to run a disk check to rule out the possibility of a dying HDD.

 

[OrbitzXT]

This is what they have here:

http://h18004.www1.hp.com/products/quickspecs/12858_na/12858_na.html

The hard drives I'm not sure of, I'd need to restart the PC which I can't do right now. They're older 600GB HDDs. I also did a Quick Scan using HDTune, it didn't report any damaged blocks. I'll be able to do a more thorough test later on when no one is here.

 

[INSTG8R]

Yeah your best bet when you have some downtime is run a full check disk, after that possibly have a go at the RAM tho that wouldn't really cause files to disappear you gotta troubleshoot from the bottom up.

Edit: Just had a thought. Do you not have your Server Box set up to run daily or at least weekly backups? If not once you get this issue sorted out it would be a good idea by the sounds of it.

 

[Steevo]

Were they found in the recycle bin of a particular user?

 

[OrbitzXT]

Yeah your best bet when you have some downtime is run a full check disk, after that possibly have a go at the RAM tho that wouldn't really cause files to disappear you gotta troubleshoot from the bottom up.

Edit: Just had a thought. Do you not have your Server Box set up to run daily or at least weekly backups? If not once you get this issue sorted out it would be a good idea by the sounds of it.

It backs up daily to two different backups. It backs up to an external hard drive we have on site and also via Carbonite online.

Were they found in the recycle bin of a particular user?

When we delete things off this server PC from ours, it seems to get permanently deleted and doesn't end up in any recycling bin.

 

[INSTG8R]

It backs up daily to two different backups. It backs up to an external hard drive we have on site and also via Carbonite online.



When we delete things off this server PC from ours, it seems to get permanently deleted and doesn't end up in any recycling bin.

Well that is as it should be then. At least outside of this particular issue you have the backups at your disposal

 

[ChristTheGreat]

It backs up daily to two different backups. It backs up to an external hard drive we have on site and also via Carbonite online.



When we delete things off this server PC from ours, it seems to get permanently deleted and doesn't end up in any recycling bin.

That is correct, but instead you need to use VSS to protect file.

Or , here's something I found: http://forums.mydigitallife.info/threads/16974-Tip-Network-Recycle-bin

I knowthat vista has an option to network oon the recycle bin, but not windows 7 :/ : http://www.techrepublic.com/article/investigating-windows-vistas-recycle-bin-properties/6090574

 

[Killer_Rubber_Ducky]

Have you considered that it could be an issue with Windows 7 / Server 2008? Has there been any updates/patches lately? I know my 7 box is prompting me to reboot for updates. As far as Servers go, I assume this is a File server? If so, why not run a Linux Desktop/Server OS like Debian or Red Hat/Fedora/CentOS? Even an Ubuntu Desktop/Server is generally more stable and reliable than the Windows Server versions. It is also easier to track what is happening to files. Not to mention the cost of Windows 7/server 2008 versus free. Just a thought.

 

[Static~Charge]

Do you have antivirus software on the server? It might be running a full scan at that time and quarantining the files.

 

[OrbitzXT]

Do you have antivirus software on the server? It might be running a full scan at that time and quarantining the files.

No, we haven't put any sort of anti-virus on it since no one ever goes online.

Have you considered that it could be an issue with Windows 7 / Server 2008? Has there been any updates/patches lately? I know my 7 box is prompting me to reboot for updates. As far as Servers go, I assume this is a File server? If so, why not run a Linux Desktop/Server OS like Debian or Red Hat/Fedora/CentOS? Even an Ubuntu Desktop/Server is generally more stable and reliable than the Windows Server versions. It is also easier to track what is happening to files. Not to mention the cost of Windows 7/server 2008 versus free. Just a thought.

I don't really have any experience with Linux so I don't feel comfortable using it.

 

[lemonadesoda]

Is someone "file-syncing" with this network share... and the sync tool has the option to delete files on target not present on source?

ie. someone has mirrored this share to a folder on their local drive. Them they deleted some files on their local. Now when they sync it deletes from the server. You restore, but hey presto, next time the user syncs, off they go again!

 

[stinger608]

Is someone "file-syncing" with this network share... and the sync tool has the option to delete files on target not present on source?

ie. someone has mirrored this share to a folder on their local drive. Them they deleted some files on their local. Now when they sync it deletes from the server. You restore, but hey presto, next time the user syncs, off they go again!

That actually makes the most logical sense here. If that is not the case, and the hard drives test good then I would suspect an outside source from the internet due to having online backup. This server obviously communicates through the internet which could open up avenues for hackers to grab files. Even if the communications are through an FTP it could still happen. I would, at the very least install Microsoft Security Essentials to ensure there is no virus. You may even check the IP addresses the server is visiting. If there is a hacker getting in then there will be a ton of IP addresses showing up on the check.

Also you could download and run Malwarebytes free edition on top of Security Essentials.

 

[Killer_Rubber_Ducky]

That actually makes the most logical sense here. If that is not the case, and the hard drives test good then I would suspect an outside source from the internet due to having online backup. This server obviously communicates through the internet which could open up avenues for hackers to grab files. Even if the communications are through an FTP it could still happen. I would, at the very least install Microsoft Security Essentials to ensure there is no virus. You may even check the IP addresses the server is visiting. If there is a hacker getting in then there will be a ton of IP addresses showing up on the check.

Also you could download and run Malwarebytes free edition on top of Security Essentials.

run a couple of Rootkit scanners as well as Hijackthis to ensure that there is nothing hidden

 

[OrbitzXT]

Is someone "file-syncing" with this network share... and the sync tool has the option to delete files on target not present on source?

ie. someone has mirrored this share to a folder on their local drive. Them they deleted some files on their local. Now when they sync it deletes from the server. You restore, but hey presto, next time the user syncs, off they go again!

Where would I check for something like this, Sync Center in Control Panel? If so, all of the computers said "You have no sync partnerships set up on this computer. Click Set up new sync partnerships to get started."

 

[Static~Charge]

Someone in your office could be running a third-party sync program like FreeFileSync or SyncBack. I don't think they register themselves with Windows, so they wouldn't show up in Control Panel.

 

[Killer_Rubber_Ducky]

Someone in your office could be running a third-party sync program like FreeFileSync or SyncBack. I don't think they register themselves with Windows, so they wouldn't show up in Control Panel.

check with CCleaner to find them. ^_^

www.piriform.com

 

[Static~Charge]

check with CCleaner to find them. ^_^

www.piriform.com

Let me expand on that statement: The server wouldn't know if a client PC was doing file/folder syncs.

 

[Killer_Rubber_Ducky]

Let me expand on that statement: The server wouldn't know if a client PC was doing file/folder syncs.

can't you run a query such as

cat

over the network? Oh right, not Unix/Linux setup. Is there something similar for Windows?