Check out my side of this panicked phone call from the early morning junior admin."What do you mean the backup did not run last night?"
"Why exactly wouldn't the tape drive be plugged into the same UPS as the library?"
"His WHAT was plugged into the ups? His cell phone? Why wouldn't you move it?"
"Yeah, yeah yeah, Of course I can get your files back I have plan 1-di0-t in place."
I checked the file server and someone definitely deleted moved or otherwise did something to our main executive share. The deleted files were already mirrored to the raid mirror and via my xcopy script this morning at 6am.
In about 10 minutes it will be 8am est and shit WILL hit the fan.
Did I mention I am not in the office and in Costa Rica? (business not pleasure kids! I'm building wireless infrastructure. Don't be jealous.)
So from the beach (OK, you can be a little jealous.) I was able to remote desktop into my file server via my favorite HP 2710p Tablet. (It works in the bright sunny light!) Yup everything was gone and there is no network recycle bin.So what did I do? How did I fix it quickly?
I restored the whole thing from Shadow Copy in 10 minutes flat.
Check out the steps I used:
First the server needs to be running 2003 or better.
Next the box needs to have shadow copy enabled on the volume with your files. Capacity is so cheap, that I have it enabled on all my servers volumes backing up 5 times a day.
Now that gives me access to 5 revisions a day going back as long as space permits. You can modify how much space Shadow Copy uses. Remember it is WAY better to be proactive and over prepared for these times than not at all. It is the difference between easy work and pulling your hair out of your head.
In this instance I opened the share right clicked choose properties and then previous versions.
I saw this:
Each of those dates and times are full folders from the specific time. Apparently my shadow copy attributes have been modified and I only have 2 copies per day... But onward and upward...
I clicked on this mornings earliest backup but the files were not there. Onto yesterdays last backup around 12pm and bingo bango I had my files I dragged the folder back to its place on the volume and was about to call it a day when I decided to find out what happened. Or at least know who did it when and if it happens again in the future.
I enabled auditing and I will show you how when I get back!
Should the junior admin be fired for not correcting the tape drive issue? How about the night admin who's cell phone was plugged in instead of my tape drive?
Now let me get back to
Getting the damn monkeys to stop eating my wires and flucking with the repeaters.
Yes Admins rule the world and can do it from the beach!
-TheEnjoyYourJobAdmiN-
