Jun 3, 2011

Recovering Deleted Offline Files in Windows 7

I haven’t had to write too much about desktop related issues recently. I’ve been mainly involved with higher level systems for the past few years, but in my new gig since I am the only IT person I have to do everything including Desktop support.

Well I got hit up by a pretty frantic user yesterday. Apparently for the last two weeks they were working on a bunch of documents in their offline file cache and didn’t realize it. Something happened and all of a sudden their cache got wiped out and everything they were working on disappeared. Holy crap right?

I went to look at their sync center in Windows 7 to see if I could browse their offline files, but they were gone. I had never really dealt with a situation like that, so of course I hit up Google. It turns out that Windows 7 saves your offline file cache to C:\Windows\CSC\v2.0.6. If you try to go in their you will get an access denied notice. It doesn’t matter if your are an administrator or not. The only way to take ownership of this particular file is to run the takeown command from command line:

takeown /f c:\windows\csc /r /a

Windows Security_2011-06-03_11-44-43After that you can get in, but guess what, his cache was completely empty. Flipping awesome! I right clicked on CSC and looked at previous versions, sure enough there were versions from the day before, but when I tried to restore the previous versions I would get access denied errors! Damn it! I even tried modifying the permissions in the previous version folder to take ownership, and couldn’t do that!

After a while of Googling around and seeing nothing, I decided to shoot for the stars and try my old free buddy Recuva. Guess what? Recuva was able to restore about 5000 documents from the users cache!

recuva2

After scanning the hard drive for missing documents, I sorted the results by file path. I restored everything I saw in C:\Windows\CSC to a network share. The user is happy, I’m happy, the issue is resolved.

Have you run into this before? Were you able to recover the files? How did you do it? Is there an easier way? Let me know in the comments.



Twitter Delicious Facebook Digg Stumbleupon Favorites More

 
Design by Free WordPress Themes | Bloggerized by Lasantha - Premium Blogger Themes | stopping spam