1

I have a customer who we have installed software onto their server. This software allows the customer to upload zip folders to a server. The software then unzips them, and puts both the zip and the unzipped files into a folder. The customer is then able to flash the firmware contained in the zip folder to devices.

We've run into a problem where we were getting a FileNotFound exception from the software. It was looking for folder00000001000\file.zip but instead there was folder00000020000\file.zip. The software is designed to make these folders and then keep track of what's in the folder (and its name) via the DB. The DB was expecting folder1, but we found that on the server was folder2.

We've never EVER (with lots of time/experience using it) seen this issue. It's almost as if somehow the folder got renamed. We seriously doubt it was a software bug, but we want to be sure. We know the customer fiddles with the server often, and may have renamed the folder

Hanlon's razor dictates that it was probably some guy who accidentally mashed his keyboard and managed to screw it up. Is there any way for me to look back at the folder's naming history? It appears that the customer does not run local shadow copies on the machine, and we're hesitant to ask them for access to the past backups, as this is likely to upset the customer (but as a last resort is possible).

1 Answer 1

1

Good description of your situation.

By my experience, you will not be able to determine if the folder was pre-existing in your situation.

Backups are your only option, and then only if the unzip and the rename did not occur within the same backup interval.

1
  • I will add that because you mention a .zip file, I presume you are speaking of a windows filesystem. Were this a Unix or Linux filesystem, you could use fsdb or debugfs that should allow you to see the structure of the directory that contained the zip file. IIRC, a linux filesystem marks a filename as deleted by replacing the first character. One disadvantage of Linux filesystems is that the (name) space is not recovered, which means that filename could still be seen with a debugger. A mv command may have overwritten that name however, so you may still be short of an answer.
    – Timbo
    Commented Nov 21, 2014 at 14:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .