0

We have recently been hit by a weird virus which made all files and folders a system files/folders and also it hid all files and folders par some weird ones it created including:

..exe porn.exe secret.exe password.exe

etc

We have managed to restore the files with attrib command to unhide and unmark them as system files however we have noticed that we are missing some 4 to 5 folders of which (based on my luck) 2 of them are the two most important client we have.

I am not sure if these files were deleted by the worm/virus or by my colleagues who are not owning up to them but the files are now gone. Worst of all, we do not have any backup what so ever (Yes I know, we should not have done that but it is a lesson learned and since last night we have created two forms of backup systems one to external device and one on the cloud, but I doubt any of that will help us now)

We have 1 Windows 2008 File server and 4 client computers based on Windows 2007. I would be grateful if anyone can help us on how we can recover from this disaster which could potentially put us out of business.

2 Answers 2

6

If these files are critical to your client and critical to your keeping them as a client then:

STOP NOW. SHUT DOWN THE SERVER AND STOP ACCESSING THE HARD DRIVES. NOW.

Then start looking for a data recovery company who can recover the data from the hard drives.

1
  • While there are additional suggestions that could be made, this is by far the correct answer.
    – Bigbio2002
    Dec 18, 2012 at 16:17
0

Try recuva , Just remember to not save any data on the partition >> this including not installing any software, so use the usb versions of the recovery software

3
  • I have sadly made the mistake of installing a number of data recovery software and also allowing staff to continue using it as a file server on most part of today. Would you now say I am fighting a lost cause? or should I continue with Recuva? Many thanks
    – aniga
    Dec 18, 2012 at 16:06
  • you need to stop all actions on this hard disk now then you have 2 choices 1- Install the harddisk as a secondary on another machine that has the recover software installed and try your luck!!. 2- Your best chance for recovery now is take off the hard disk and take it to a specialized data recovery agency, they will perform a hardware data recovery which is deeper and more thorough than software data recovery. Dec 18, 2012 at 16:14
  • 1
    If this is critical data then STOP accessing the drive and STOP trying to recover the data yourself. Find a data recovery company and get the drive to them for recovery of the data.
    – joeqwerty
    Dec 18, 2012 at 16:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .