How to recover moved/deleted folders from a shared drive?

Question

A user(from his PC) has accidentally moved/deleted a folder(located on Windows Server 2012 R2). Folder is not backed up and not saved anywhere else. Is there any way of recovering same? No logs can be found in event viewer as well.

* Moved from Community Center

Answer 1

Hello,

Windows Server 2012 and 2012 R2 machines will be discontinued on October 10, 2023, after which Microsoft will no longer provide security updates and technical support.

Reference link: Windows Server 2012 R2 - Microsoft Lifecycle | Microsoft Learn

Therefore, it is recommended that you upgrade your system or reproduce the issue with a newer version of the machine that is still covered by technical support so that you can continue troubleshooting.

Best regards,

Jingjing Wu

Answer 2

In a working environment you would recover the files from any daily or weekly backups you have of the shared data. This would be from Windows Backups or third-party backups your have purposefully scheduled. If you do not have such backups scheduled you would rely on any Volume Shadow copies (VSS) to see if the files exist there to restore. The volume containing the shared data would have needed to have VSS enabled for that volume to be covered.

Auditing object access would need to be explicitly enabled in your policies to capture the user making such changes in your event logs. That would only be an audit trail used to locate the culprit, not an actual copy of the files.