Hello, Earlier this week I went to a client’s business to finish some work on their server. Something went horribly wrong and I could use some help figuring out what happened.
Some background information first… This is a small business with about 15 workstations and a single Server 2003 SBS installation. Their C: drive is a mirror of two 80GB drives using a Silicon Graphics SATA RAID card (add on card, not an original part of the server). Several months ago I added two new hard drives (mirror, software RAID1) to expand their storage capacity. This week I stopped by to finalize the data migration to the new drives and to put everything back together. I unplugged all the SATA cables and put it all back together. I am fairly confident that the two drives for the OS were reconnected to the proper ports on the RAID card, otherwise I feel the RAID BIOS would have given me an error message. I booted the server and it began loading Windows without an issue. I logged in with my domain administrator account and noticed that some of my extra share definitions were gone. Weird, so I readded them. Seeing the correct date/time/etc I went to the first workstation to log in and verify everything was OK. Would not login – complained that the domain was not there or else the computer account was disabled. Rebooted, same issue. Logged in locally and pinged the server OK. Rebooted and tried again – no luck. Reset the computer account in AD, no luck. Unjoined the domain and joined again – now it works. Decided to do this to all the workstations so that the users could get back online. Called it a night and went home… My customer called the next day and complained that they are missing all their email/calendar entries after 2/11/2010. Nothing is there after that date except for new items that came in after I left for the night. I checked the event logs – same thing! Log files are all blank from 2/11/2010 until 4/14/2010. The Windows ntbackup logs also do not recognize the backup file from last week – and it won’t restore that data. It appears as though Windows lost two months of data. I’m at a loss as to how this could have happened. The only initial thought is that I swapped the SATA cables on the OS mirror set… but it’s a mirror, so it should be in sync 100%, not 2 months behind! Since this is a consumer level card it has no usable tools or log files that I can see. Swapping the cables again sounds dangerous to me – I don’t believe that it would be a safe thing to do. Has anyone heard or experienced anything like this? Does the community have any other options that I might be able to try? They are currently using the server but I can get in there at any time to try something… anything! Thanks, Richard Maloley II "I've lost a machine... Literally _lost_. It responds to ping, it works completely, I just can't figure out where in my apartment it is."
_______________________________________________ Tech mailing list [email protected] http://lopsa.org/cgi-bin/mailman/listinfo/tech This list provided by the League of Professional System Administrators http://lopsa.org/
