Recovering trashed files
ireid (1283 pencils) | Fri, 2008-05-30 23:29Ok. I have a small problem. One of the animators has been working on a project for the last 3 months and came to me yesterday to say: "I can't find it on my system"
Well I'm stumped. Its NOT on his computer anymore and spotlight searches don't bring it up even if I search by date OR by visibility.
So I've come to the conclusion that a. someone hacked into our firewalled network, logged into his machine and DELETED those files (highly unlikely) OR b. Someone INTERNALLY went onto his machine and did a manual deletion.
I'd like to know is A. Can I do like in the old days and run a 'Norton' and search the trash for the files to see if they were in FACT deleted and not gone due to a corruption on the drive itself? or B. Is there anyway to recover the data if it was in fact deleted.
Management is having a cow and talking about beefing up security! I see pain coming my way so any assistance would be appreciated.
thanks
"Try not, Do! or do not, there is no try."
-Yoda
Commenting on this Forum topic is closed.
When you find an answer to this, I'd love to know. I had a "doh" moment where I worked on a spec on on my desktop, had it saved to my desktop and then after a while, I thought the ad was done and entered into our PMP product so trashed it from my desktop.
Our IT guy couldn't locate it for the life of him - not even on our backup server which automatically does backups of our desktops. It was GONE. I had to rework the whole thing from scratch.
So, I'll be keeping a close eye on this to see if there's a solution, or if you're just S.O.L. if you're not backing up to Time Machine or something.
Edit....
I had a similar issue a couple years back where someone deleted my "Customers" folder from my drive. I used FileSalvage, which recovered files ok, but they didn't recover with their original names, so it was a huge pain.
The other option I was looking at was Data Rescue from Prosoft. It looked pretty good, though I can't speak from experience.
But did you ever find out who did it? Is there anyway to tell how it was done? This is 50% of my problem. I'm like CSI trying to find out whodoneit!
"Try not, Do! or do not, there is no try."
-Yoda
...but there are loads of file recovery applications for OS X.
I had to buy an application once after one of the girls on our team managed somehow to lose all the content on her new external hard drive.
Even I have no idea ho it happened, I was in the room as we were setting her up with the new machine and one minute the data was there, the next it had gone.
It was only about $60 I think, I can't remember what it was called, but it listed all the deleted files and then allowed us to recover about 95% of them
www.jamnittygritty.com
Someone with the skill to hack your network is probably not going for just one file on a mac desktop. Not worth the effort!
Your managers need to worry about the real problem with is lost revenue from this file being lost, right?
----
Powerpoint is not a design application
----
Dirt and Rust
Your $60 app sounds good. I wish you could remember what it was. I really miss the old Norton Utilities Unerase (or whatever is was called -- see? You're not the only one!) The new OSX Time Machine is okay for what it does, but for something that goes WHAM on you between backups, you're outta luck.
On a related topic, is there a way to recover long and meticulously worded forum posts that disappear because you accidentally clicked on something that made the window go away? That happens to me a lot. Maybe it's God's way of telling me to shut the **** up and get back to work ;-) But it seems to me that the data ought to be somewhere.
Mara
It's called Data Rescue II
http://www.prosofteng.com/index.php?datarescue
www.jamnittygritty.com
Mara
Do you require signons to your computers? If not, you might want to start doing that. Then you can track who logged onto what computer when and you won't have to wonder if you got hacked or not.
Make sure your user doesn't do anything else on that computer before you can run file recovery software on it. The files are there, but since you can't find them your computer thinks those areas on the hard drive are fair game to wipe forever with new data...
----
Powerpoint is not a design application
----
Dirt and Rust
Our CD made his decision. He will change the password on this machine and he will be the only one who knows it along with the user. He's given up on wanting to recover it so that's out. The OFFICIAL policy is to make EVERYONE change their passwords, but since this is a studio set up EVERYONE shares everyone else's files so changing passwords will be a nightmare when we need to log into people's machines if they are not there.
MORE ammo for them to institute a PROPER back up solution.
The fight continues.
"Try not, Do! or do not, there is no try."
-Yoda
Sometimes you just have to let things take their course, and hopefully the powers that be will make the correct decisions.
In this case, the first time you desperately need to get at the files on someones machine and nobody who knows the password can be reached, they will probably figure it out.
But I guess more than that, I am baffled as to why he wouldn't want to try to recover it. There are some feasible solutions that don't involve starting over again, thats for sure.
Create an admin account on each machine that is accessible to only you. Problem solved.
You'd just have to make sure all work files are stored in Drop Box.
Another way is to force your users to be non admin account users. Then you have full control of what they download on their machines.
----
Powerpoint is not a design application
----
Dirt and Rust
But I was fearful of the whole permission issues thing by putting current jobs in the dropbox for daily use. Besides how would that WORK excatly?
Scenario: 20 macs. 12 artists. 7 Copywriters. 1 Animator. No direct link to each machine (don't ask its IT policy) only through a shared server resource with 300 gb of space. Our average current job folder is 20 gb per machine. The Animator is possibly bigger. (hell ONE project was 9 gb!) go figure!
Whats the best plan of action with this set up?
"Try not, Do! or do not, there is no try."
-Yoda
1 Terabyte wasn't even enough for 6 artists (and dozens of projects added weekly) so 300gb seems tiny and insufficient for your needs. Get NAS (network accessible storage) and have all artists share that. Permissions are controlled on the server drive itself so you can limit and track who touches what.
The Drop Box on each computer works by not assigning restricted permissions to files. It's a protected area on a computer and doesn't allow access to any other part of the computer.
With your IT being so stringent and with you using macs, I find it HIGHLY unlikely that your issue or "hack" is an outside job. What management NEEDS to do is increase your storage and add more onsite and offsite back ups. No more lost files.
----
Powerpoint is not a design application
----
Dirt and Rust
Make sure you're all storing your projects on the shared server (so everyone can access anyone's work at any time) and implement a tape or other backup method for your shared server. You may need to discuss purchasing a larger drive if you're running out of space too quickly on the shared server.
We have only four official artists here, but with the volume of work we have to do, we have several shared servers we work from. I'm personally the biggest space-hog and I actually have my own separate backup system because my projects get so ginormous. Mine's pretty lame and old school, but at least it's a back up - I back up all my completed projects to DVDs.
I bet you that it was someone internally that screwed up and doesn't want to admit it due to the repercussions that he or she could face.
This may sound a little archaic, but what you could do is have everyone handed a piece of paper with two check boxes: YES and NO. The questionnaire would be brief: "Did you accidentally erase XX file from this machine?" An anonymous admission is better than nothing in this case. The person probably already feels like a royal jerk and it's probably killing them to see everyone put through the wringer due to his or her foul-up. The result--no one is put on the spot and everyone can breathe a little easier knowing that they aren't working alongside a malicious asshole. However, if that doesn't flush the system, or you receive more than one checked YES 'cause everyone is not really looking forward to the new regime, then you really should send the drive out to a professional data recovery centre.
"Without deviation from the norm, progress is not possible."
— Frank Zappa
"Art -- the one achievement of Man which has made the long trip up from all fours seem well advised." - James Thurber
If he saved the file there has to be a way to recover the file.