Deleted file on network drive

Question

I deleted a file on a network drive. Is it possible to get it back? It is not in my recycle bin, and it is not in the recycle bin on the server to which I have a network drive too.

Answer 1

Unless the server has some kind of "network recycle bin" (like the QNAP NAS for instance), you're out of luck, the file is gone.

When you're deleting a file stored on a network drive, you're just sending a command to the server to delete the file. Network delete orders are not using the recycle bin, unless some third party tools are installed to provide such a functionnality.

There is a workaround, not 100% foolproof, explained here:

1. Map a network drive to the network share you want to use. Make sure that the drive is re-connected on logon. If you don't know how to do this, search Google.
2. Browse to C:\users\.
3. Right-click on one of the folders in this location (I chose saved games) and click properties.
4. Select the Location tab.
5. Click Move, browse to to root of the drive you mapped in step 1, and click Select Folder.
6. Click Ok and click yes in the dialogue box that appears.
7. Repeat these same steps for all users on the computer.

You can now verify that the network drive is protected by the recycle bin by right-clicking on the recycle bin and clicking properties. The network drive should be listed in the Recycle Bin Locations column.

Some warnings: 1. This only protects files accessed through the mapped network drive, and not by UNC paths. So for example, if you mapped \server\share to z:, and delete something off the z drive, it will go to the recycle bin. However, if you browse to \server\share and delete a file, it will be deleted directly. 2. I don't know what will happen if your network drive is not available, so beware. This may not work well with laptops. 3. What ever files that were supposed to be stored in the folder you select in step 3 will now be stored on your mapped network drive by default. This can actually be quite useful.

Future goals: I don't currently know how to add this functionality to additional folders. As far as I can tell, only folders stored in C:\users\ get this functionality. I'm still looking into this, but will update this post if I find additional information.

It won't help of course with a file already deleted. If you have access to the server, you could try with an undelete utility, but little chances of success.

Answer 2

The ability to recover your file or not depends on the Server configuration. In order to recover the file the administrator must have enabled Shadow Copy beforehand. If so, on the Server machine navigate to the folder that used to contain the file, right click on the folder and select Previos Version.

More information here:

http://technet.microsoft.com/en-us/library/cc787329(WS.10).aspx

Good luck with the recovery!

Answer 3

It is possible, but if this is busy File Server, the possibility decreases exponentionally with every minute the disk is in operation.

Shut down the network drive immediatelly. If this is a NAS unit, remove the disk from the case and plug it in a computer. Then use one of the free or commercial programs for file recovery.

Testdisk, Autopsy Forensic Browser come to mind. There are number of live CD's out there that include file recovery software.

The most important thing now is to stop writing on the disk in question.