Data lost, and reverted to up specific time and date, how?

[IntercompVisoko]

I am having a case which I will try hard to explain. I directly wasn't there to witness it, they called some kid to fix their server, and then called us when it was all over.

Let's begin.

Server started to restart itself, with BSOD and all that, and this kid (assuming he's telling the truth) said he somehow forced the Windows Server OS to boot, with Disk Check completing successfully. Then they call me, saying all data from 8/13/2013 is missing. I established following:

- Mirror that was in place was broken, and Windows sees 4 partitions (2 HDDs) with same identical data. How that happened, I don't know, it was in BIOS of the HP server.
- OS was not re-installed, and folders on partitions were not overwritten by some old backup
- Event viewer showed some fatal and unexpected errors for the following services: Shadow Copy, Partition Manager
- Data Recovery software has not found single trace of the missing folders from 8/13/2013 to present
- HDD health is seemingly OK, no bad sectors.

My best bet is that OS, and maybe the Shadow Copy service, malfunctioned.

I am asking you, what could have done this? I already pointed them to professional service for data recovery, but I am curious what could this be? Did you have any experience?




Thank you.

[Dmitri]

Disk Check completing successfully

Depending on how "successfully" check disk performed, that could be all the diagnostics, actually.
CHKDSK /F shreds the information mercilessly, fixing errors feeling no concern for data.

Check if there are folders named FOUNDNNN -- (pieces of) the data you're looking for can be there.

Data Recovery software has not found single trace of the missing folders from 8/13/2013 to present

Further review is necessary.
It could have happened that one of the drives fell out of sync some time ago and contained outdated data therefore. What happened after the recent failure, which of the drives has been checkdisk'ed and how kid / controller behaved are the things, which better to be discussed after looking into the job.