Hello,
We have a client who had data corruption on a large scale (virus) and did not have an active backup. Shadow Copy was enabled, but failed when attempting to restore using built-in Shadow Copy recovery. Folder and File level recovery failed.
We were able to use a tool called Z-VSSCopy to restore file-by-file, but as that was underway (days) the shadow copy service continued to run and eventually ran out of space, overwriting the shadow copies we were restoring from.
I know, I should have modified the schedule or at least increased the available size for shadow copies, but that is a lesson learned too late.
In viewing the shadow copy data in the \System File Information folder, I saw that the copies were in fact deleted, but I noticed two files that were from a month ago.
Z-VSSCopy and built-in are not recognizing them (or vssadmin) but I can see the data is still there. One is 300+ MB and the other 100+ MB.
Is there a way I can force recovery using data contained in these files, or are they lost?
I'm currently running a Data Recovery program in hopes I can recovery anything, but since there has been significant writing on this disk since the incidence, I have little hope.
Any help is GREATLY appreciated. Thanks.