Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have recently been hit by a weird virus which made all files and folders a system files/folders and also it hid all files and folders par some weird ones it created including:

..exe porn.exe secret.exe password.exe

etc

We have managed to restore the files with attrib command to unhide and unmark them as system files however we have noticed that we are missing some 4 to 5 folders of which (based on my luck) 2 of them are the two most important client we have.

I am not sure if these files were deleted by the worm/virus or by my colleagues who are not owning up to them but the files are now gone. Worst of all, we do not have any backup what so ever (Yes I know, we should not have done that but it is a lesson learned and since last night we have created two forms of backup systems one to external device and one on the cloud, but I doubt any of that will help us now)

We have 1 Windows 2008 File server and 4 client computers based on Windows 2007. I would be grateful if anyone can help us on how we can recover from this disaster which could potentially put us out of business.

share|improve this question

2 Answers 2

If these files are critical to your client and critical to your keeping them as a client then:

STOP NOW. SHUT DOWN THE SERVER AND STOP ACCESSING THE HARD DRIVES. NOW.

Then start looking for a data recovery company who can recover the data from the hard drives.

share|improve this answer
    
While there are additional suggestions that could be made, this is by far the correct answer. –  Bigbio2002 Dec 18 '12 at 16:17

Try recuva , Just remember to not save any data on the partition >> this including not installing any software, so use the usb versions of the recovery software

share|improve this answer
    
I have sadly made the mistake of installing a number of data recovery software and also allowing staff to continue using it as a file server on most part of today. Would you now say I am fighting a lost cause? or should I continue with Recuva? Many thanks –  aniga Dec 18 '12 at 16:06
    
you need to stop all actions on this hard disk now then you have 2 choices 1- Install the harddisk as a secondary on another machine that has the recover software installed and try your luck!!. 2- Your best chance for recovery now is take off the hard disk and take it to a specialized data recovery agency, they will perform a hardware data recovery which is deeper and more thorough than software data recovery. –  BluesRhythm Dec 18 '12 at 16:14
1  
If this is critical data then STOP accessing the drive and STOP trying to recover the data yourself. Find a data recovery company and get the drive to them for recovery of the data. –  joeqwerty Dec 18 '12 at 16:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.