Latest posts by Timothy Warner (see all)
- Specops Password Auditor - Detect weak password policies - Tue, Oct 31 2017
- Azure Backup – Easily back up Windows to the cloud - Thu, Oct 26 2017
- NAKIVO Backup & Replication v7.2 new features - Wed, Oct 25 2017
The Windows Recycle Bin has been with us for a long, long time. Most Windows administrators know some basic truths on file deletion in general and the Recycle Bin in particular:
- You can customize the Recycle Bin's maximum size on a per-volume basis.
- Files deleted from the Recycle Bin may be recoverable as long as new data or security software doesn't overwrite the files' occupied NTFS clusters, but need a tool such as Undelete to recover these files.
- Files deleted from network or removable drives typically bypass the Recycle Bin and are inaccessible unless you have a backup.
- You need to connect via Remote Desktop Protocol (RDP) to remote file servers to access their Recycle Bins.
We can look at Condusiv Undelete Server as an enterprise-class Recycle Bin replacement for Windows Server. Condusiv sells Undelete Professional for desktop systems. However, in this article I will limit my analysis to the server version.
Install the software ^
You should download the free, full-featured 30-day demo and install it on at least two Windows Server servers. The system requirements are modest; the installer is a single signed executable, and installation took all of one minute with no reboot required.
One thing I liked about the Undelete Server installer is that you can use it for emergency undeletes, which allows use to try to recover files that were deleted before Undelete was installed, as the next figure shows:
That means you should add the Undelete Server installer to your troubleshooting USB stick because it may come in handy some day!
Configure and use the Recovery Bin ^
After installation, the first thing you'll notice is that the Undelete Recovery Bin has replaced the old Recycle Bin. Take a look at the next screen shot, and I'll teach you how to configure your new bin.
A: You can manage the local server or connect to other file servers in your environment that have Undelete Server installed (more on that later).
B: You can configure Recovery Bin on a per-drive basis, or use a single Common Bin which contains the deleted files from all the selected volumes.
C: You can enable "secure delete," which makes files unrecoverable by scrambling the files' resident disk clusters before the file is deleted.
D: Files deleted before Undelete was installed or files emptied from Recovery Bin may be recoverable with Undelete Server's "dig deeper" feature.
Double-clicking the Recovery Bin opens the Undelete Server user interface. Don't be alarmed when you see an empty screen like the following:
The Recover Files screen requires action on your part. Specifically, you should click Filter to query the Recovery Bin for the file(s) you need. You can either search for all files or specify search parameters.
For example, in the following screenshot I query the Recovery Bin for .txt files deleted in the past seven days:
Sure enough, I receive results, shown in the next screenshot.
In the previous screenshot, I selected a file named PRODUCT_KEYS.txt. Undelete gives me the following information:
- What its file type is
- When the file was deleted
- Who deleted the file
- Where its original location was
Note you can restore the file either to its original location or to an alternate location.
Recover files from over the network ^
Condusiv Undelete Server gets more interesting when we install and activate the product on two or more file servers on the same network.
From the Recover Files page, click Menu > Connect to Network Share and fill out the form. In the following screenshot example, I connect to the FILESHARE shared folder on a file server named ADVM on my local network.
The great benefit in mounting a file share from a remote server that has Undelete Server on it is that you can retrieve content deleted from that file server from your local machine! As shown in the next screenshot, I can restore deleted PowerShell scripts from that location. I don't know about you, but I've had to restore deleted file share content hundreds of times over my career; it's never been this simple to pull the files from a remote server's Bin.
Another way is to click Menu > Connect to Remote Computer to open the target machine's Recovery Bin. Be advised that this connectivity method relies upon the following ports:
- TCP 13621
- TCP 14482
Perform emergency file recovery ^
What happens if you or a colleague empties an Undelete Server's Recovery Bin? Worse, what happens if someone emptied the Recycle Bin on an unprotected file server? As I said earlier, Undelete Server Edition includes emergency undelete capability.
In the first case, let's empty the Recovery Bin on a protected server. Here, running a query in Undelete Server will turn up no results by default, especially if time has elapsed in the meantime. That said, we can click Menu > Dig Deeper to unlock emergency recovery.
Recall that files become inaccessible in the file system only after new data has overwritten some or all of the deleted files' clusters.
In the following screenshot example, I undertake a "Dig Deeper" search for .txt files deleted from my file server's C: drive.
The "Dig Deeper" choice does not reduce the necessity of regular and religious file backups, but it is a nice safeguard.
As mentioned earlier in this post, you can run an emergency delete operation from the Undelete installer. The following screenshot shows this interface:
In conclusion ^
As of this writing, a single license of Undelete Server costs $499.95. Condusiv will give you a volume license discount if you want nine or more licenses. To me, Undelete Server is a "must have" utility for your core infrastructure file servers.
You can offset the license cost by considering the following factors:
- The value of being able to recover accidentally or inadvertently deleted content locally or remotely
- The peace of mind in knowing you have built-in deletion protection on your file servers
- The convenience of not having to rely upon your backup software to do file-level restores