No matter how much computer experience you have, the day will come when you need to recover a deleted file. Condusiv Undelete Server gives Windows systems administrators network-aware file recovery, emergency undelete, and even basic auditing.

Timothy Warner

Timothy Warner is a Microsoft Cloud and Datacenter Management Most Valuable Professional (MVP) who is based in Nashville, TN. Check out his Azure and Windows Server video training at Pluralsight, and feel free to reach out to Tim via Twitter.

The Windows Recycle Bin has been with us for a long, long time. Most Windows administrators know some basic truths on file deletion in general and the Recycle Bin in particular:

  • You can customize the Recycle Bin's maximum size on a per-volume basis.
  • Files deleted from the Recycle Bin may be recoverable as long as new data or security software doesn't overwrite the files' occupied NTFS clusters, but need a tool such as Undelete to recover these files.
  • Files deleted from network or removable drives typically bypass the Recycle Bin and are inaccessible unless you have a backup.
  • You need to connect via Remote Desktop Protocol (RDP) to remote file servers to access their Recycle Bins.

We can look at Condusiv Undelete Server as an enterprise-class Recycle Bin replacement for Windows Server. Condusiv sells Undelete Professional for desktop systems. However, in this article I will limit my analysis to the server version.

Install the software ^

You should download the free, full-featured 30-day demo and install it on at least two Windows Server servers. The system requirements are modest; the installer is a single signed executable, and installation took all of one minute with no reboot required.

One thing I liked about the Undelete Server installer is that you can use it for emergency undeletes, which allows use to try to recover files that were deleted before Undelete was installed, as the next figure shows:

Emergency undelete is built into the installer

Emergency undelete is built into the installer

That means you should add the Undelete Server installer to your troubleshooting USB stick because it may come in handy some day!

Configure and use the Recovery Bin ^

After installation, the first thing you'll notice is that the Undelete Recovery Bin has replaced the old Recycle Bin. Take a look at the next screen shot, and I'll teach you how to configure your new bin.

Configuring the Undelete Recovery Bin

Configuring the Undelete Recovery Bin

A: You can manage the local server or connect to other file servers in your environment that have Undelete Server installed (more on that later).

B: You can configure Recovery Bin on a per-drive basis, or use a single Common Bin which contains the deleted files from all the selected volumes.

C: You can enable "secure delete," which makes files unrecoverable by scrambling the files' resident disk clusters before the file is deleted.

D: Files deleted before Undelete was installed or files emptied from Recovery Bin may be recoverable with Undelete Server's "dig deeper" feature.

Double-clicking the Recovery Bin opens the Undelete Server user interface. Don't be alarmed when you see an empty screen like the following:

I know I deleted some files!

I know I deleted some files!

The Recover Files screen requires action on your part. Specifically, you should click Filter to query the Recovery Bin for the file(s) you need. You can either search for all files or specify search parameters.

For example, in the following screenshot I query the Recovery Bin for .txt files deleted in the past seven days:

Searching the Recovery Bin

Searching the Recovery Bin

Sure enough, I receive results, shown in the next screenshot.

Restoring files in Undelete Server

Restoring files in Undelete Server

In the previous screenshot, I selected a file named PRODUCT_KEYS.txt. Undelete gives me the following information:

  • What its file type is
  • When the file was deleted
  • Who deleted the file
  • Where its original location was

Note you can restore the file either to its original location or to an alternate location.

Recover files from over the network ^

Condusiv Undelete Server gets more interesting when we install and activate the product on two or more file servers on the same network.

From the Recover Files page, click Menu > Connect to Network Share and fill out the form. In the following screenshot example, I connect to the FILESHARE shared folder on a file server named ADVM on my local network.

Mounting a remote file share

Mounting a remote file share

The great benefit in mounting a file share from a remote server that has Undelete Server on it is that you can retrieve content deleted from that file server from your local machine! As shown in the next screenshot, I can restore deleted PowerShell scripts from that location. I don't know about you, but I've had to restore deleted file share content hundreds of times over my career; it's never been this simple to pull the files from a remote server's Bin.

Undelete from across the network

Undelete from across the network

Another way is to click Menu > Connect to Remote Computer to open the target machine's Recovery Bin. Be advised that this connectivity method relies upon the following ports:

  • TCP 13621
  • TCP 14482

Perform emergency file recovery ^

What happens if you or a colleague empties an Undelete Server's Recovery Bin? Worse, what happens if someone emptied the Recycle Bin on an unprotected file server? As I said earlier, Undelete Server Edition includes emergency undelete capability.

In the first case, let's empty the Recovery Bin on a protected server. Here, running a query in Undelete Server will turn up no results by default, especially if time has elapsed in the meantime. That said, we can click Menu > Dig Deeper to unlock emergency recovery.

Recall that files become inaccessible in the file system only after new data has overwritten some or all of the deleted files' clusters.

In the following screenshot example, I undertake a "Dig Deeper" search for .txt files deleted from my file server's C: drive.

Performing a "dig deeper" search

Performing a "dig deeper" search

The "Dig Deeper" choice does not reduce the necessity of regular and religious file backups, but it is a nice safeguard.

As mentioned earlier in this post, you can run an emergency delete operation from the Undelete installer. The following screenshot shows this interface:

Emergency undelete

Emergency undelete

In conclusion ^

As of this writing, a single license of Undelete Server costs $499.95. Condusiv will give you a volume license discount if you want nine or more licenses. To me, Undelete Server is a "must have" utility for your core infrastructure file servers.

You can offset the license cost by considering the following factors:

  • The value of being able to recover accidentally or inadvertently deleted content locally or remotely
  • The peace of mind in knowing you have built-in deletion protection on your file servers
  • The convenience of not having to rely upon your backup software to do file-level restores

Win the monthly 4sysops member prize for IT pros

Share
0

Related Posts

2 Comments
  1. Tom 2 weeks ago

    You briefly mentioned this in your article but what led us to Undelete was knowing WHO deleted the file. We had a certain VIP user who kept complaining her files were "missing" and was upset we couldn't tell her who deleted them. So we were looking at the various options of enabling auditing and archiving the logs or buying expensive products to audit our file shares when we switched directions towards this product. We can now find out who deleted the file plus put it back instantly without doing a file restore. You don't get the full data (like file moves, creations, ACL changes, etc.) you get with auditing but it met our primary goal of being able to tell this user who keeps deleting her files (shocker: it was her).

    We run it on our primary file cluster so it only cost us $1,000 for two licenses to cover the majority of our data. We added a 2 TB clustered volume and use that as the recycle bin so we should be able to go back at least a year (it's only been a few months).

    0

    • Author
      Timothy Warner 3 days ago

      Hi Tom. Thanks for sharing--that's an excellent "real world" example. I like how you strategically licensed the software as well. Kudos! -Tim W.

      0

Leave a reply

Your email address will not be published. Required fields are marked *

*

CONTACT US

Please ask IT administration questions in the forum. Any other messages are welcome.

Sending
© 4sysops 2006 - 2017

Log in with your credentials

or    

Forgot your details?

Create Account