Finding the elusive "not saved" file


we have a rather concerning and frustrating problem which i don't really know how to tackle. a few users (not many) are reporting they have saved a file, and the next day they come to open it but the file is back to how it was before they saved it. there are no errors during application close (its not just one application it is different software from different vendors), and the problem can not be replicated on demand. at first glance you might think the user clicked "no" to the save dialog box, but the people in question aren't that gormless and they know how important their modifications are.

we have a file server which holds a lot of data, this FS data share is mapped to users computers (J drive), we do not enable offline files, or "make available offline" for this share. three people have experienced this problem, one does use folder redirection with offline files, whilst the other two don't.

the first area i looked at is the server, we have three types of backups; incremental hourly, full backup daily, shadow copies at 7:00 and 12:00. looking through all these backup points i can see the modified dates run chronologically so there is no "reverting" back to a previous point, however it would appear that the file's modified date in question jumps from one day, to the next, even though there was a modification performed during this timeframe.

to me, this indicates that the write never actually made it to the server, the client never presented any failure or error message - the user assumed the save was successful, closed the file and went home. the next day she opened the file and realised all her work from the previous day was gone. yet she can successfully save to this location because i can see the modified date from today and last saved by her username.

to illustrate, here is a table below of the file in question based on our backup points and the modified time stamps

you can see in each type of backup the file never got reverted, however somewhere during the highlighted time-frame from the 19th May at lets say 12:00... until 16:00 that day, the User 2 made a change to that file and saved it, but as you can see the file was modified the day before at 12:28, then user 1 modified it at the end of the day at 16:36 - where was User 2's modification between 12:00 and 16:00 on the 19th?

this is extremely worrying because we don't really know if saves are occurring or not. I would imagine the problem may lie on the client side, but there wasnt a forum for Windows 7 storage, i'd imagine you guys would know more. I did attempt to look into the NTFS log file but i dont really know what i'm doing there or how to extract it, file saves aren't written to the event logs either so it makes it very difficult to know what's going on. if there were an easy way to just pull off the NTFS transaction logs on both server and client then maybe we could get somewhere but I am not having any luck with that.

anyone ever experienced such a thing??? I never have, I've used Shares, SSD, HDD, SATA, SAS, Virtual Disks - never had this kind of problem, this is new to me. As i understand it, when an application saves a file, the disk has to acknowledge that first and return the success to the App, only then will the app close... so the file must have saved somewhere or the App wouldn't have closed, they say they never discarded the changes and I believe them.



  • Edited by Steve Mills Wednesday, May 20, 2015 2:35 PM
May 20th, 2015 2:30pm

Hi Steve,

What's the operation system of the server and all clients?

If Windows 7 and Windows 2008 R2 are involved, try to install this hotfix on all these systems first.

Also is there any change that more than 1 user could access a same file (and saved different copy, so previous save was overwritten)?

Free Windows Admin Tool Kit Click here and download it now
May 21st, 2015 5:12am

Hi, thanks I am looking into that hotfix, this may take a week before i apply the patch though and update this thread.

As a precaution i have removed anti-virus in case there was some locking issue on the files, we have a similar issue where a user deletes a file from a network share, it removed the file, then a few seconds later appears back - subsequent deletions fail with the "try again" message (because the first deletion was actually successful, it just doesn't seem to refresh the disk, this even happens with the admin directly on the server), if left for a while eventually explorer shows the view correctly with those files now deleted. I'm beginning to think these two issues are related, very difficult to diagnose though because it can't be done on demand, its random.

Systems are Win7 and 2008 R2

no, other users did not access the file and overwrite it.

thank you


May 22nd, 2015 3:00am

IS DFS involved in some manner?

If so, there are multiple potential culprits, like:

Last writer wins, if multiple people save a document on different DFS instances.

Replication might be configured in a way, that files on one of the DFS servers are overwritten.

Replication does not work at all, and users randomly get connected to the one or the other DFS server.

Other ideas:

Also somebody could play around with Previous Versions "just for fun" or not knowing what they do.

Any scheduled tasks, which copy stuff to the wrong direction?

You could enable file system auditing for the folder hierarchy in question.

Best greetings from Germany

Free Windows Admin Tool Kit Click here and download it now
May 22nd, 2015 3:34am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics