restored but not restored

[Kevin MacDonald]

I have a windows 2000 SBS that I am having a very large problem with. I did
a complete system backup with about a month ago Feb 8th and nothing since. I
did a complete system backup again on March 8 but after a did this
everything since Feb 19 has disappeared. All working files, all Emails since
Feb 19, inventory files. It is like either it was restored to some hidden
backup done on the 19th??? or I have been hacked and redirected to a twin
server since the 19th?? All my clients have been receiving Emails all along
and no interruption had happened at any time between the two backups. Also
since the backup everything is now updating again?

Does anyone have any ideas about what has happened. I think my very
important server was on acid and did everything but now remembers nothing???

Thanks

 

[Pegasus \(MVP\)]

I am a little confused about some aspects of your post.
Here is what I gather:

- You did a complete system backup on 8 Feb. What program
did you use to do the backup? Where did you back up to?
What does the backup log report.
- You did another complete system backup on 8 March. Same
questions as above.
- After the 8 March backup, all user files created since 19 February
have disappeared. "It is like either it was restored to some hidden
backup done on the 19th???" What restore? You never mentioned
any restore!

Is it possible that the backup of 8 March was not a backup at all
but a restore? Could you have allowed the restoration to place the
backed up files into their original location, thus overwriting what
was there?

There are some rules of thumb when backing up business data:
- Have separate backups for system files and for user files.
- Back up user files daily.
- Examine backup reports daily until things settle down, then
weekly.
- Back up your backup reports.
- Store backup media (e.g. tapes) at a different site.
- Keep at the very least two generations of backup media
(because you might be backing up corrupted data).
- Retrieve some sample folders from back up twice a year.
- Before retrieving data, move the current data to some
other location so that it does not get overwritten.

 

[Freaky Pants]

To answer your question: No it s not possible that the March 8 was not a
restore because I would have restored files and Emails back to Feb 8 not Feb
19. I thought the same thing at first ( after a large amount of sweating )
but I have only a report and a record of a "backup" on both the two days
mentioned. I am starting to lean towards a write caching failure of some
type. It is the only way I can explain the server behaving normally up until
it restarted on March 8th just before I did the backup. Another problem that
may enter into the mix is that my Norton Antivirus on the server was still
open from a scheduled backup when I first logged onto the server. It seemed
to be just reporting that it had found a virus and had deleted it. The last
thing that was written to the hardrives between Feburary 19th and March 8th
is that Norton Antivirus did a liveupdate.

Anyway this one scares the hell out of me. I don't have any explanation. I
am going to change my IDE RAID controller which I only use for Mirroring
with the Write Caching Disabled, but this is only a quess.

Thanks for your response
Kevin