we have a rather concerning and frustrating problem which i don't really know how to tackle. a few users (not many) are reporting they have saved a file, and the next day they come to open it but the file is back to how it was before they saved it. there are no errors during application close (its not just one application it is different software from different vendors), and the problem can not be replicated on demand. at first glance you might think the user clicked "no" to the save dialog box, but the people in question aren't that gormless and they know how important their modifications are.
we have a file server which holds a lot of data, this FS data share is mapped to users computers (J drive), we do not enable offline files, or "make available offline" for this share. three people have experienced this problem, one does use folder redirection with offline files, whilst the other two don't.
the first area i looked at is the server, we have three types of backups; incremental hourly, full backup daily, shadow copies at 7:00 and 12:00. looking through all these backup points i can see the modified dates run chronologically so there is no "reverting" back to a previous point, however it would appear that the file's modified date in question jumps from one day, to the next, even though there was a modification performed during this timeframe.
to me, this indicates that the write never actually made it to the server, the client never presented any failure or error message - the user assumed the save was successful, closed the file and went home. the next day she opened the file and realised all her work from the previous day was gone. yet she can successfully save to this location because i can see the modified date from today and last saved by her username.
to illustrate, here is a table below of the file in question based on our backup points and the modified time stamps
you can see in each type of backup the file never got reverted, however somewhere during the highlighted time-frame from the 19th May at lets say 12:00... until 16:00 that day, the User 2 made a change to that file and saved it, but as you can see the file was modified the day before at 12:28, then user 1 modified it at the end of the day at 16:36 - where was User 2's modification between 12:00 and 16:00 on the 19th?
this is extremely worrying because we don't really know if saves are occurring or not. I would imagine the problem may lie on the client side, but there wasnt a forum for Windows 7 storage, i'd imagine you guys would know more. I did attempt to look into the NTFS log file but i dont really know what i'm doing there or how to extract it, file saves aren't written to the event logs either so it makes it very difficult to know what's going on. if there were an easy way to just pull off the NTFS transaction logs on both server and client then maybe we could get somewhere but I am not having any luck with that.
anyone ever experienced such a thing??? I never have, I've used Shares, SSD, HDD, SATA, SAS, Virtual Disks - never had this kind of problem, this is new to me. As i understand it, when an application saves a file, the disk has to acknowledge that first and return the success to the App, only then will the app close... so the file must have saved somewhere or the App wouldn't have closed, they say they never discarded the changes and I believe them.
- Edited by Steve Mills Wednesday, May 20, 2015 2:35 PM