Recovering Offline Files from the Client-Side Cache

Today I had a problem after trying to clean up a very heavily virus/spyware infected PC. The workstation had had its links with the server severed as part of the clean up as well as offline files being disabled when the network driver ndis.sys was attempted to be replace for a “clean” copy.

This meant all the users files, actually stored on the server and only cached on the workstation, were lost – panic.

Well panic not. After searching around on the net including Microsofts knowledge base I found out about the Client-Side Caching Command-Line tool. This is included as part of the Microsoft Windows 2003 Support Tools, however the version required to extract the files is 1.1 and only avaliable from Microsoft Product Support Services…or by click this link here.

You will need to copy the CSC folder (%SYSTEMROOT%\CSC) from the inaccessible drive to the new Windows installation.

Now, ensure “Fast User Switching” is disabled (KB279765) and offline files is enable by either:

http://support.microsoft.com/kb/307853

or

csccmd /enable

Create a directory where you wish to restore the files to and then run:

csccmd /extract /target:C:\CscRestore /recurse

That’s it! You will find the full server shared path in the CscRestore directory containing any and all offline/cached files.