Files Gone!...

[TC53]

Situation: we have tens of thousands of files (mainly word processing docs),
on our 2003 file/print server. Now seemly random files are gone! I can't
figure out why!?....
I did notice that when I use vss for files to get these missing files back,
that they all seem to be missing after Sep.24th 12pm (my afternoon vss
snapshot). So something has happened that evening, (on the 25th at 7am I
have another snapshot taken and the files are not there).

Variables: Using NTBackup to VS-80 tape drive, Acronis TrueImage Server 9.1
creating differential images nightly to an external USB HD. I verified that
neither backup routine crosses over each other (time wise). The image for
that night finished with no errors, but the backup died during the backup of
the system state, (however all our files and such finished their backup)

Question: At first I chalked it up to users deleting files, but now I'm not so
sure... has anyone heard of this before, or have any thoughts/suggestions?
Thanks...

 

[itsp1965]

Do you have auditing enabled on the affected folders? A glimpse through the event log might lead you to a possible culprit.

 

[TC53]

there are 1000s of files and folders, so far they seem to be random, all users have full access to them, I've checked the window log, acronis logs, NTbackup logs. No errors whatsoever, except for the NTbackup that evening died during the system state, (it never got to the verification stage), but that should be unrelated (NTbackup copies, not deletes..). And it hasn't happened since, so enabling auditing won't do much for me after the fact...

 

[itsp1965]

Well there is nothing usually random about 1000s of files/folders dissapearing on you. What is the security like on these files/folders. Is it possible an errant job may have moved the files somewhere else?
Since you don't have auditing in place already is there anything in the security logs between Sept 24th VSS copy and the time you discovered the missing files
Even though it may be late to enable auditing, I would still recommend you do it in order to be able to capture this info the future.

 

[TC53]

No security on these folder/files, the users have to be able to create,move,edit,delete on this mapped drive, (yes,... nightmare... but they need the access). I would suspect an errant move (which does occassionaly happen with open security like this), but that is usually in one specific folder or group of folders,... this is random files/folder (unrelated, different departments...). I'm having the users double check their files/folders (so I can restore any missing ones via vss, before 2003 deletes the snapshot of the 24th). As far as I can figure, it has to be someone (spitefully or ignorantly) deleting them?... I can think of no other cause, can you?