A whole fileshare is suddenly empty or gone
First do not panic, but immediately stop writing to that share. This could be ransomware, a user who deleted a lot by mistake, or a corrupt filesystem.
Try this first
- 1Disconnect the share from users right away. On the file server: stop the SMB share. Prevents colleagues from overwriting data.
- 2Check the file server event logs for mass deletes or encryption patterns. A row of .encrypted or .lock files smells like ransomware; then a different playbook (see suspected-ransomware).
- 3Check whether Volume Shadow Copies are on for the server (vssadmin list shadows). Sometimes the most recent snapshot from hours ago saves you.
- 4No shadows or corrupt: backup restore. Not on top of the live share, but to a staging location so you can compare before swapping.
When to bring us in
A vanished fileshare could be ransomware, but also hardware failure or human error. Call us before you restore; we first assess what happened, otherwise you restore over an attacker who is still inside.
See also
- We have backups but we do not know if they workA backup that cannot be restored is not a backup. Testing matters as much as taking the backup.
- Suspected ransomware: what to do RIGHT NOWThe first 30 minutes are critical. One wrong move spreads the damage. Read before acting.
- Someone accidentally deleted an important folderUsually fine to recover. The trick: do not save anything new on that drive until you know how.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.