4

In Windows Server 2012 I copy a large file 13GB (file A) and overwrite to same file name but different path (file B). It prompted overwrite and I click Yes. It copy about 5%, and I immediately press cancel.

My question is did file B any part of the file been amended? It is a database file. Because I notice the modified had been updated.

Update:

I create a dummy text file try to simulate the situation again.

Create a file => a\dummy.txt

a>echo aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa > dummy.txt

a>for /L %i in (1,1,25) do type dummy.txt >> dummy.txt

Create another file => b\dummy.txt

b>echo bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb > dummy.txt

b>for /L %i in (1,1,25) do type dummy.txt >> dummy.txt

It generate about 2GB for each text file.

I tried copy and paste in local PC environment and press yes for replace the file, it run about 10% I press cancel. The destination file just disappeared.

Then, I tried in Network environment, which is the real situation that I was having before. I actually copy from a server A replace to backup server B. The same thing happened. The destination file also disappeared.

When I copy and paste and press cancel. The destination file just disappeared. Any idea to prove the file had been amended?

Shiro
  • 697
  • 5
  • 12
  • 27
  • You now have approximately 5% of a new file, but space already reserved for all 13GB. The old file was overwritten. – Tetsujin Jul 24 '15 at 16:59
  • Means file B is totally overwritten? 5% new file, 95% corrupted file? – Shiro Jul 24 '15 at 17:12
  • Yes, it is gone, but it might be recoverable by some ntfs undelete tool, but there is NO way of knowing if the recovered file is really identical to the file you deleted, unless you have a valid tested backup, but then a recovery attempt would be pointless. – Uwe Burger Jul 24 '15 at 20:41
  • I added a test scenario to simulate the situation again but it seem like different outcome. – Shiro Jul 25 '15 at 04:54
  • try check raw disk content with winhex – lex Jul 25 '15 at 06:52
  • 1
    Hm. The difference might be that the other file was held open by the DB server and thus could not be deleted. Could you repeat your tests after [locking the file](http://www.jensscheffler.de/filelocker)? – Bob Jul 27 '15 at 04:49
  • Might also try locking [just delete](http://superuser.com/a/857831/117590) so read/write is still possible (specify "ReadWrite" instead of "None"). Just in case the DB server operates in that mode, as unlikely as it is. – Bob Jul 27 '15 at 05:20
  • Hi Bob, may you suggest how to lock, or can you do a test and is it the file really amended or not. Thanks – Shiro Jul 27 '15 at 06:26
  • (Bob already linked to [a lock utility](http://www.jensscheffler.de/filelocker) and [another option](http://superuser.com/a/857831/117590) in his comments.) – Arjan Jul 27 '15 at 08:11
  • But the problem is my situation my db file, I did not have "the process cannot access the file because it is being used by another process." I can just paste it. Can I use checksum to verify? – Shiro Jul 28 '15 at 05:14
  • OK, thanks for the easy file locker program. I manage to simulate the case. – Shiro Jul 28 '15 at 06:07
  • 2
    Since you answered the question yourself, and quite extensively, I refunded the bounty, also considering that there are no other answers. This is more of an exception though. – slhck Jul 28 '15 at 07:38

1 Answers1

4

Thanks for all the comments. The conclusion is even through only few percentage is copy. The file confirmed amended.

Below is the case study.

With Delete Checked, If it only few percentage copied. I press cancel. The fill will be delted.

With Delete Checked, If it only few percentage copied. I press cancel. The fill will be deleted.

Next, I changed the deletable to unchecked. With this option, when I cancel the copy operation, the original file will not be deleted. enter image description here

I noted down both a\dummy.txt and b\dummy.txt checksum.

As I copy b\dummy.txt and immediately cancel it. I run the checksum to check the file. It is confirmed the checksum is different.

So by this testing. I can concluded that if you copy a file, even through you cancel it. The file already amended.

Thank you everyone for you comment contribution. So do backup first before overwrite your file.

Shiro
  • 697
  • 5
  • 12
  • 27