Recovering files to a network target

There are often cases where the recovered files are copied over the network. On Windows, the network target is usually a network share, named per Windows standards as \\SERVER\SHARE. You can use IP address instead of server name, and the path becomes \\1.2.3.4\SHARE.

The process is not as straightforward as it seems. Problem is, your desktop is run at user security level, even if you are logged in as administrator. On the other hand, ZAR, Klennet ZFS Recovery, or any other recovery software runs at so called elevated security level. This is required for direct disk access. Therefore, even if you map your network share to a drive from your desktop, recovery software cannot see it. The drive is mapped in your security context, not in elevated security context.

How to map the drive into the elevated security context?

  1. On the Windows Start, find Command Prompt.
  2. Right click it, pick Run as Administrator. This produces an elevated instance of Command Prompt console.
  3. Into the Command Prompt, type the following command
    net use X: \\SERVER\SHARE /user:USERNAME PASSWORD
    where X: is a unused drive letter to map to, \\SERVER\SHARE is the network path, using either a sever name or an IP address, and USERNAME and PASSWORD should be something that the target sever accepts. This command will map the drive X: in elevated security context, so that it will be seen by the recovery software.

Sometimes, if you have multiple network connections open, the mapping operation may fail with this error message

Multiple connections to a server or shared resource by the same user, using more than one user name are not allowed. Disconnect all previous connections to the server or shared resource and try again.

or

The network folder specified is currently mapped using a different user name and password. To connect using a different user name and password, first disconnect any existing mappings to this network share.

In this case, a solution, albeit a bit extreme, is to type the following into the elevated Command Prompt.
net use * /delete
While it will certainly resolve the conflict, it will also disconnect all current connections and unmap any mapped drives you may have, so keep this in mind.

Created Friday, June 14, 2019

I have a low volume mailing list, for news and tips, which I send out once or twice a month.
Subscribe if you are interested.