How to recover files in Microsoft Windows Server 2016 using BackDating™



By Peter Learmonth for Beyond The Blocks - Tuesday, March 28, 2017

Recovering files in Microsoft Windows Server 2016 using BackDating
BackDating enables organizations to instantly recover data. Read to learn how.

Overview

Reduxio BackDatingTM is a unique capability of the Reduxio TimeOS architecture that enables administrators to recover volumes back to any second available in the system's history. But what about files and folders? How can one restore these individually?

This blog describes a step-by-step process on how to perform such a data recovery in Microsoft Windows Server 2016. It assumes there is already a volume assigned and connected to the Windows file server.

Lets get started!

First, get the name and path of the affected files or directories from the user, along with the time they think the objects were intact.

Identify the Reduxio volume that has the Windows volume containing the data you need recovered.  If you name your hosts and volumes on Reduxio to match your Windows servers and their volumes, this should be simple.  You can verify by comparing the SerialNumber of wmic diskdrive get output to the WWID shown in the TimeOS web interface.

In Windows Disk Management, identify which physical disk contains the Windows volume (drive letter) of the missing files.

From a Windows command prompt, use the wmic diskdrive get command to find the serial number of the physical drive.

In the TimeOS web interface under HOSTS & VOLUMES, select the volume, then click the flip arrow button next to the NAME field to see additional properties.

The WWID should match the SerialNumber as seen by Windows.

In this case the WWID "6f4032f0010f00000000000000000025" matches the Serial Number for Disk2 we got in the command prompt.

Host&Volume_Screen_noborder.png


Next step is to click CLONE / BOOKMARK button.

Use the time slider or DATE / TIME fields to select a time to which to backdate the volume, or select an existing bookmark.

TimeOS_Bookmarks_Screenshot_nobg.png

Click CLONE.

Either accept the default name or enter a unique name for the clone and Click CLONE.

The clone success message will briefly appear.

TimeOS_Success_Message_transparent.png

The new cloned volume will appear in the list of volumes.

Assign the cloned volume to a Windows Host

Assign the cloned volume to a Windows host.  It can be the original host or a designated recovery host, depending on your recovery workflow and needs.

In the Reduxio web interface Hosts and Volumes screen, select a Windows host.

Click the cloned volume and drag onto the volumes portion of the host box.  If you drop over the “Assign LUN automatically (#)” box Reduxio will assign the first available LUN ID. If you drop over the “Assign LUN manually” box, the wizard will prompt for a LUN ID.

TimeOS_Assign_LUN_automatically_nobg.png

Now, open Windows Disk Management using run command diskmgmt.msc. In Windows Disk Management, click Action → Rescan Disks.

Disk_Management_Rescan_Disk.png

You will now see a offline disk appear. (Here it is Disk 3, and it will say offline)

Disk_Management_disk_offline.png

To make it online, right-click and click 'Online'

Disk_Management_disk_online.png

Tadaaa!!!

The cloned volume is now accessible as a Windows volume.

You can do one of the two things below to recover/access the files/folders.

  • You can now copy files and folders from the cloned volume to the original volume by simply dragging and dropping in Windows Explorer.
  • You can also give users direct access by sharing the cloned volume in Windows or mounting the cloned volume on an empty folder in the existing share.

Mounting the Cloned Volume

To mount the cloned volume within the original volume.

1. Create an empty directory such as “\backdate”

2. Open Windows Disk Management, right-click the partition of the cloned disk

3. Change Drive Letter and Paths

4. Click Add, then browse for the path to the empty directory you created and click OK.  

**Note that this Windows functionality may not be supported in some file systems such as ReFS.

When finished recovering files and folders, it is a best practice to clean up by deleting the cloned volume.

Cleaning Up

1. In Windows take the volume offline using Windows Disk Management.

2. Now, go to Reduxio Web interface, select the volume then click DELETE. Enter yes to confirm, then click DELETE.

 

So Simple! Right?

Yes, it is that easy and instantaneous with BackDatingTM

To learn more about Reduxio BackDatingTM technology, and to see behind the scenes on how it actually works. Watch the short screencast below.

 

Learn how one of our customers used BackDatingTM to recover from a Ransomware attack within minutes. Download the Case Study from the link below to read the full story.

Get the Barnstable Police Case Study!

Peter Learmonth

Written by Peter Learmonth

Peter Learmonth has over 29 years of industry experience as an Instructor, Systems Engineer, Tech Marketing Engineer and Consulting Systems Engineer. US patent holder related to Virtual Machine cloning methodology and VMware Certified Professional 3, 4 and 5, he has presented at VMworld and other large Technical Forums. After almost 16 years at NetApp, he is currently Sr Systems Engineer for Reduxio in Northern California. He is married with 2 children, but still finds time to jump out of airplanes and try not to crash his mountain bike. He earned his private pilot certificate in June 2016.



Want to comment on this blog post?