| Archive for Downsizer For an ethical approach to consumption |
| tahir |
File delete, whodunnit?We've recently installed some new payroll software on our NT4.0 server, for some reason the data files get deleted (not every time) when the program is exited.How do I find out who or what deletes the files? They're not in Recycler just deleted. The vendors obviously don't support their product on NT4 but are aware of no similar issues, the thing's written in MS Access so I can't see any compatibility issues. |
| dougal |
Dunno.
Vague memory of something, somewhere, that lied about creating a new data file. Seemed to work. But the file was actually in cache somewhere. There was a permissions problem about actually writing the file... The variable result you get might be due to the use of different login accounts, with different permissions... If you have created and deleted a file, it'll probably be there and recoverable with Norton or somesuch un-delete tool. But if it wasn't created properly, it won't be there at all. |
| tahir |
I'll try some undelete tools. |
| tahir |
Just run into a problem, the data is on a RAID5 array, the data recovery tools I've got work only on physical volumes... |
| dougal |
Dunno. Again.
Perhaps a vaguely helpful comment might be that you shouldn't be trying to do any heavy duty data recovery - just "un-deleting" a file (if its there). ISTR that windoze 'deletes' the file just by marking the filename in the catalog(ue) by setting one bit in the first character of the filename (making it 'high-ASCII'). So, as long as the file hasn't been overwritten, restoring it just involves writing the proper character back into the filename. Which I'd have thought would be equally easy on an array. But is this correct for NT? Dunno! |
| tahir |
It's OK I've found a tool that'll recover off a RAID, it's found the file and recovered it, just need to know who or what deleted it.
Just in case anyones interested it's R-Undelete from www.r-tt.com |
| dpack |
makes my problems seem easy 
|
| Treacodactyl |
Can you flag it as read only, then when the program tries to delete it again it may throw an error, if it doesn't you could try removing it first and then seeing if you get an error? |
| tahir |
I think I'm going to create backups and watch exactly what they do the next time they run it. |
| mrutty |
Step 1: - Upgrade server.
Step 2: - Beat up vendor for a fix |