Offline files recovery

Holy moly. For the first time in many years, I have found myself inadvertently breaking the golden rule of IT work. I did not leave myself a way back, or at least for about 30 scary minutes I thought I had not.

What happened is a client had a machine connected to a defunct Windows domain. This domain had not existed in a few years because the domain controller was long broken down. However, the client continued to log into her domain account, and, more critically, had continued to save all of her critical files to a network drive letter tagged for offline caching.

Not thinking anyone would do this, I mindlessly just joined her machine to a new domain. And of course things went downhill from there, when she told me where her files really were. Naturally, I could not log back into her other profile to recover those files, because that domain was forever gone.

As she was about to start crying, I frantically searched for a solution. Thoughts of copying the old profile to the new one came to mind, and I was about to do that (maybe that was a good solution, don't know), but then I stumbled onto the real answer I was looking for.

Offline cached files are stored under %systemroot%\CSC. I checked there, and it was full of things, so I figured that was a good thing.

There is a tool called csccmd.exe which will restore whatever is in that folder to an alternate location. So for example, you will want to create a folder called c:\restored. Then run the csccmd.exe with the following arguments:

csccmd /extract /target:C:\restored /recurse

(the /recurse argument puts things in all the right subfolders)

csccmd.exe is part of Windows 2003 resource toolkit:

Hope this helps someone.