The USB HD enclosure failed on Oct. 5th and the Server's HD got a case of file corruption Oct. 17th, which was discovered when the computer wouldn't boot due to "NTLDR Missing".

I fixed the boot issue and ran sfc /scannow to restore the Operating System files and the O/S now functions normally with no errors in Event Viewer, nor any other issues.

However, industry-specific EMR software (meaning, no documentation anywhere) stores all of it's database data in a file (example) "C:\Program Files\EMR Software\Main Directory\Data"

The good news: The software does not "install" to the hard drive. I am told by the EMR software companies support tech that you can copy the file structure from one computer's hard drive and paste it into another, and as long as the filepath names are correct, the software will be fully, 100% functional.

The bad news: The software MUST have the entire "...\data" directory in order to be able to use the database(s). They are all inter-related and you cannot paste a piece of one into a piece of another and be functional. I need an entire copy of this sub-directory/folder, more recent than the 5th, as all of this data is going to have to be manually reconstructed.

While doing research on this issue I discovered something called "Shadow Copy" and I am wondering if the data may be available somewhere on the HD, if I knew where to look. Also, I wonder about exactly how the read/write operations work and if perhaps there isn't a complete copy of this directory somewhere on the hard drive, and the software shuts down every night and the computer restarts in order to do a maintenance routine.

I could not see the "find copies of this file" tab in "Properties", and I wonder if there isn't a way to "manually" search whatever is stored/saved by "Shadow Copy". Failing that, I wonder if there isn't a deleted copy of the folder somewhere. The data is constantly changing, but the software shuts down each day. Does this imply that there may be a complete folder somewhere on the HD, or that it's probably NOT there. I can't decide which is more likely.

They blame me for the problem because the data corruption happened when I pulled the Server's HD out to clone it as a safeguard against data lose and somehow during the cloning process the data got corrupted. I blame the USB enclosure, and the customer blames me, so any help on this would be greatly appreciated.

Shadow copy is no avaliable in all MS products.
Whitch O.S. you have?


See: http://en.m.wikipedia.org/wiki/Shadow_Copy

www.shadowexplorer.com/



also try some forensic tools, I think there is something in the open source tools autopsy - sleuthkit, but the tool Im thinking of may be by someone that I heard talk around the same time I was looking at Autopsy.

Also Runtime.org has some tools for SC.

just google for Shadow Copy utils

What software/utility were you using to create the clone?
How often do you create the clone? If often enough, then perhaps you could restore from last clone copy. Also, you could try studying the file structure on a prior clone to confirm one of your theories as far as what that "data" folder should contain.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts