Recovering Deleted Files on a Network Drive for Windows

If you need to map a network drive for a Windows PC, please refer to the article https://uwaterloo.atlassian.net/wiki/spaces/ISTKB/pages/284524979


Network drives are backed up on an hourly, daily and weekly basis:

  • Hourly backups are created at 5 minutes past the hour and are available for a period of 48 hours in a rolling window from the current time.

  • Daily backups are a single instance stored at 12:10AM each day and are held for 14 days (2 weeks) from the current day.

  • Weekly backups are stored as of 12:15AM every Sunday and are held for 17 weeks or about 4 months from the current date.

  • Backups are not maintained beyond 4 months from the current date due to a lack of space required to keep more than this amount.

You must be connected to the Cisco AnyConnect VPN in order to view your network drive(s) from off-campus. For instructions on how to connect to the VPN, please refer to https://uwaterloo.atlassian.net/wiki/spaces/ISTKB/pages/262012980

Step-by-step

  1. Open Windows File Explorer.

  2. Select This PC, select the R: drive, select the ~snapshot folder


    This will display a list of folders. The backup (snapshot) list is alpha-numerical so “Daily” snapshots are listed at the top, “Hourly” in the middle, and “Weekly” at the bottom.
    a. Note: the actual backup date and time may not match the precise date and time based on the folder name, but it will be within a day and all backup folder names use these specific patterns.

    • Daily = “daily.yyyy-mm-dd_0010” (all daily backups are as of 12:10AM EST.)

    • Hourly = “hourly.yyyy-mm-dd_tttt” (times for “tttt” will be 24-hour time of the latest 48 hours at 5 past the hour from “0005” for 12:05AM through to “2305” for 11:05PM).

    • Weekly = “weekly.yyyy-mm-dd_0015” (available while they are among the latest 17 weeks of backups, with the date being a Sunday in the calendar year at 12:15AM or 15 minutes past midnight of Saturday evening into Sunday morning EST).

  3. Open the folder with the backup you want to recover a file from.

  4. Copy the file onto a location on your computer once you locate it and open the file to ensure it contains the information you are looking for. You may need to locate another backup copy if the file is blank, corrupt, or missing some of the data you are looking for.

For N: drive backups

Note this option is available only to users who have not migrated to OneDrive. If you are unsure whether you have migrated, contact your IT support rep.

  1. Open Windows File Explorer.

  2. Copy this path and paste it into the path bar \\fileu.uwaterloo.ca\users$\~snapshot (Note: you must have the N: drive mapped).


    This will display a list of folders. The backup (snapshot) list is alpha-numerical so “Daily” snapshots are listed at the top, “Hourly” in the middle, and “Weekly” at the bottom.

    1. Note: the actual backup date and time may not match the precise date and time based on the folder name, but it will be within a day and all backup folder names use these specific patterns.

    2. Do not try to open a folder at this level. Each snapshot contains a listing of ALL usernames with an N-drive (thousands). It will take anywhere from 30 minutes to more than an hour for the list to be complete and for it to show your username. You can wait to see the full list, but you will only have permission to view the contents of your own.

    3. Read the explanation below (items i to iv) and then use the manual method in step #3 to save yourself from waiting an exceptionally long time.

      1. Take a screenshot of the folder names or be aware of the naming convention for the backup names. Note: the actual backup date and time may not match the precise date and time based on the folder name, but it will be within a day and all backup folder names use these specific patterns.

      2. Daily = “daily.yyyy-mm-dd_0010”

        1. Text “daily” a dot, 4-digit year, hyphen, 2-digit month, hyphen, 2-digit day, underscore 0010 (all daily backups are as of 12:10AM EST.)

        2. So, a daily backup for 2020-Dec-25 will =daily.2020-12-25_0010

      3. Hourly = “hourly.yyyy-mm-dd_tttt

        1. Times for “tttt” will be 24-hour time of the latest 48 hours at 5 past the hour from “0005” for 12:05AM through to “2305” for 11:05PM.

        2. Hourly backup for 2020-Dec-25 at 1:05PM = hourly.2020-12-25_1305

      4. Weekly = “weekly.yyyy-mm-dd_0015”

        1. Weekly backups from Jan. 2020 are… weekly.2020-01-05_0015, weekly.2020-01-12_0015, weekly.2020-01-19_0015, weekly.2020-01-26_0015, weekly.2020-02-02_0015, and so on… – and are only available while they are among the latest 17 weeks of backups, with the date being a Sunday in the calendar year at 12:15AM or 15 minutes past midnight of Saturday evening into Sunday morning EST.

3. Click on the path bar that shows the snapshot and add to the path the backup folder that you want to view + your 8-character UWaterloo username (ie. \\fileu.uwaterloo.ca\users$\~snapshot\weekly.2021-12-12_0015\username)

4. Press enter to view the files and folders in that backup folder.

5. You can now browse your folders and files from that backup date to locate the desired file.

6. Copy the file onto a location on your computer once you locate it and open the file to ensure it contains the information you are looking for. You may need to locate another backup copy if the file is blank, corrupt, or missing some of the data you are looking for.

7. When you are done, right-click on the snapshot share, and then click Disconnect.

Need help?

Contact the IST Service Desk online or 519-888-4567 ext. 44357.

Article feedback

If you’d like to share any feedback about this article, please let us know.