locked
So I had my first serious issue - data deleted from WHS share RRS feed

  • Question

  • While working on my WHS PP3 (which had been stable for a couple of years), I was copying some files to one of the shares. Not really doing anything unusual or that I haven't done before, but while the remote console was up at the Shares view I noticed that the Photos share was down to 0 bytes from normally around 15GB. I go to look at the share and sure enough, every single file was gone. I go to look at previous versions of that share, and it does have one listed, so I try to restore it which starts working. It seems to have gotten most of the files back. While it's working I go and check with the wife to make sure she hadn't done anything unusual with the photos share or loaded any software that might have touched it (she hadn't). A few minutes later I pull the remote console up again and look at the shares tab, and this time my Docs and Music were also wiped out! Within a few minutes Docs went from ~450MB and Music ~29GB, and now both were 0 bytes. To make matters worse, when I try to pull up previous versions of those Shares I get the message "device is not connected" when trying to restore. Both seem to be gone for good.

    I've searched through all the logs for any errors and haven't found anything useful. I looked in the C:\fs directory and the files actually were gone, not just the pointers. I rebooted and ran chkdsk on the server and it had no issues. All of the shares had data duplication turned on. A bug in the single instance store process is about the only logical explanation I can think of for a cause, but the files that got wiped had been sitting out on the server for a year and nothing had updated them. I also have another share I had added myself, and it also had data duplication enabled, but it survived just fine.

    Fortunately I had invested in an online backup system which saved me, but this is way too close a call. I have now attached an external USB drive, but was disappointed to find there is no way to automate a backup to it. So for now I'll probably add a scheduled xcopy task to work around it. I would like to verify that having WHS view it as a Backup drive won't enable data dedupe or do anything that would prevent the files from being restore to a non-WHS machine. Can someone confirm?

    Sorry for the long note, but wanted to document the issue in case anyone runs into something similar. Wish I had more details on the root cause.

    Saturday, January 2, 2010 10:24 PM

Answers

  • While working on my WHS PP3 (which had been stable for a couple of years), I was copying some files to one of the shares. Not really doing anything unusual or that I haven't done before, but while the remote console was up at the Shares view I noticed that the Photos share was down to 0 bytes from normally around 15GB. I go to look at the share and sure enough, every single file was gone. I go to look at previous versions of that share, and it does have one listed, so I try to restore it which starts working. It seems to have gotten most of the files back. While it's working I go and check with the wife to make sure she hadn't done anything unusual with the photos share or loaded any software that might have touched it (she hadn't). A few minutes later I pull the remote console up again and look at the shares tab, and this time my Docs and Music were also wiped out! Within a few minutes Docs went from ~450MB and Music ~29GB, and now both were 0 bytes. To make matters worse, when I try to pull up previous versions of those Shares I get the message "device is not connected" when trying to restore. Both seem to be gone for good.

    I've searched through all the logs for any errors and haven't found anything useful. I looked in the C:\fs directory and the files actually were gone, not just the pointers. I rebooted and ran chkdsk on the server and it had no issues. All of the shares had data duplication turned on. A bug in the single instance store process is about the only logical explanation I can think of for a cause, but the files that got wiped had been sitting out on the server for a year and nothing had updated them. I also have another share I had added myself, and it also had data duplication enabled, but it survived just fine.

    Fortunately I had invested in an online backup system which saved me, but this is way too close a call. I have now attached an external USB drive, but was disappointed to find there is no way to automate a backup to it. So for now I'll probably add a scheduled xcopy task to work around it. I would like to verify that having WHS view it as a Backup drive won't enable data dedupe or do anything that would prevent the files from being restore to a non-WHS machine. Can someone confirm?

    Yep, the server backup is completely separate from the shares.

    Sorry for the long note, but wanted to document the issue in case anyone runs into something similar. Wish I had more details on the root cause.

    Did you happen to look at the modified date of the shares from the server desktop (i.e. D:\shares\Music)?  I can't imagine everything deleted itself.  Is there anyone else in your household with access to the server?  Any chance someone was in your server through the Remote Access website and was deleting files?  What are the component numbers on your server?
    Sunday, January 3, 2010 1:12 AM
    Moderator

All replies

  • While working on my WHS PP3 (which had been stable for a couple of years), I was copying some files to one of the shares. Not really doing anything unusual or that I haven't done before, but while the remote console was up at the Shares view I noticed that the Photos share was down to 0 bytes from normally around 15GB. I go to look at the share and sure enough, every single file was gone. I go to look at previous versions of that share, and it does have one listed, so I try to restore it which starts working. It seems to have gotten most of the files back. While it's working I go and check with the wife to make sure she hadn't done anything unusual with the photos share or loaded any software that might have touched it (she hadn't). A few minutes later I pull the remote console up again and look at the shares tab, and this time my Docs and Music were also wiped out! Within a few minutes Docs went from ~450MB and Music ~29GB, and now both were 0 bytes. To make matters worse, when I try to pull up previous versions of those Shares I get the message "device is not connected" when trying to restore. Both seem to be gone for good.

    I've searched through all the logs for any errors and haven't found anything useful. I looked in the C:\fs directory and the files actually were gone, not just the pointers. I rebooted and ran chkdsk on the server and it had no issues. All of the shares had data duplication turned on. A bug in the single instance store process is about the only logical explanation I can think of for a cause, but the files that got wiped had been sitting out on the server for a year and nothing had updated them. I also have another share I had added myself, and it also had data duplication enabled, but it survived just fine.

    Fortunately I had invested in an online backup system which saved me, but this is way too close a call. I have now attached an external USB drive, but was disappointed to find there is no way to automate a backup to it. So for now I'll probably add a scheduled xcopy task to work around it. I would like to verify that having WHS view it as a Backup drive won't enable data dedupe or do anything that would prevent the files from being restore to a non-WHS machine. Can someone confirm?

    Yep, the server backup is completely separate from the shares.

    Sorry for the long note, but wanted to document the issue in case anyone runs into something similar. Wish I had more details on the root cause.

    Did you happen to look at the modified date of the shares from the server desktop (i.e. D:\shares\Music)?  I can't imagine everything deleted itself.  Is there anyone else in your household with access to the server?  Any chance someone was in your server through the Remote Access website and was deleting files?  What are the component numbers on your server?
    Sunday, January 3, 2010 1:12 AM
    Moderator
  • Here is the version information:

    Windows Home Server Console: 6.0.2361.0
    Windows Home Server Backup & Restore: 6.0.2361.0
    Windows Home Server Drive Extender: 6.0.2030.0
    Windows Home Server Remote Access: 6.0.2361.0
    Windows Home Server Storage Manager: 6.0.2361.0

    I'm not sure what you mean by modified date of the share. No remote logons were logged, and no one else in the house except the dog, who isn't much of a WHS user.

    Sunday, January 3, 2010 5:15 AM
  • I would also run a full virus scan, preferably from a bootable DVD, on all PCs that were connected to the server at the moment the data vanished.
    Regards, Martin
    Sunday, January 3, 2010 7:30 AM
  • Here is the version information:

    Windows Home Server Console: 6.0.2361.0
    Windows Home Server Backup & Restore: 6.0.2361.0
    Windows Home Server Drive Extender: 6.0.2030.0
    Windows Home Server Remote Access: 6.0.2361.0
    Windows Home Server Storage Manager: 6.0.2361.0

    You have the beta version of PP3 installed.  You should uninstall it from the server desktop, reboot your server, then run the updates from the Console to get the RTM version of Power Pack 3.

    I'm not sure what you mean by modified date of the share.

    It's probably too late now (I'm assuming you already added data back), but if you look at the folders from the server desktop, you will see a modified date on each one.  If you haven't added anything since your files disappeared, you could at least see when the files disappeared from the modified date.

    No remote logons were logged, and no one else in the house except the dog, who isn't much of a WHS user.

    You never know.  :)
    Monday, January 4, 2010 2:40 AM
    Moderator
  • I would also run a full virus scan, preferably from a bootable DVD, on all PCs that were connected to the server at the moment the data vanished.
    Regards, Martin
    And a virus scan of the server (using an A/V designed for WHS) wouldn't hurt either...
    Monday, January 4, 2010 2:41 AM
    Moderator