Recovering files to a network target

There are often cases where the recovered files are copied over the network. On Windows, the network target is usually a network share, named per Windows standards as \\SERVER\SHARE. You can use IP address instead of server name, and the path becomes \\\SHARE.

The process is not as straightforward as it seems. Problem is, your desktop is run at user security level, even if you are logged in as administrator. On the other hand, ZAR, Klennet ZFS Recovery, or any other recovery software runs at so called elevated security level. This is required for direct disk access. Therefore, even if you map your network share to a drive from your desktop, recovery software cannot see it. The drive is mapped in your security context, not in elevated security context.

How to map the drive into the elevated security context?

  1. On the Windows Start, find Command Prompt.
  2. Right click it, pick "Run as Administrator". This produces an elevated instance of Command Prompt console.
    Important: you need to use "Run as Administrator" even if you are already logged in as Administrator.
  3. Into the Command Prompt, type the following command
    where X: is a unused drive letter to map to, \\SERVER\SHARE is the network path, using either a sever name or an IP address, and USERNAME and PASSWORD should be something that the target sever accepts. This command will map the drive X: in elevated security context, so that it will be seen by the recovery software.


Mapped drives still not visible

If you did all the above, and you try to save files, and you don't see your mapped drive in the "Save to" selection options, most likely you missed the step 2 above, which is to use "Run as Administrator" menu option. Being simply logged in as an administrator is not enough.

Mapping fails

Sometimes, if you have multiple network connections open, the mapping operation may fail with this error message

Multiple connections to a server or shared resource by the same user, using more than one user name are not allowed. Disconnect all previous connections to the server or shared resource and try again.


The network folder specified is currently mapped using a different user name and password. To connect using a different user name and password, first disconnect any existing mappings to this network share.

In this case, a solution, albeit a bit extreme, is to type the following into the elevated Command Prompt.
net use * /delete
While it will certainly resolve the conflict, it will also disconnect all current connections and unmap any mapped drives you may have, so keep this in mind.

Created Friday, June 14, 2019

Updated 23 Nov 2020