Server Hacked???

[SoCalMacDude]

An open sales database running on an XServer got replaced or annihilated! Was 90Mb file with 8500 records, many layouts.

Now it's 12K, zero records, 2 layouts named "Layout#1" and "Layout#2" and 3 fields. When I tried to open it later, it was damaged.

So I tried to recover it, Filemaker errored "Sales.fp7 was not created by Filemaker or is severely damaged and cannot be opened."

What happened? Any ideas?

[bruceR]

What exactly do you mean the file was "open and running on an XServe"?

It doesn't sound like you're running FileMaker Server.

[Vaughan]

Start looking for backups.... you do have backups, right?

[bruceR]

It sounds like you were opening the file using operating system file sharing, not FileMaker Server.

If so - this the result you can expect. Your files WILL be destroyed. Do not ever open FileMaker files that are stored on a file server.

[SoCalMacDude]

Sorry, Filemaker Server 8.5, installed on an XServe computer, was hosting a few databases, working perfectly for years. The database was suddenly not available for login, and when I opened that database in Filemaker Pro, it was empty as I described above.

I was able to restore from a backup, but my customer is concerned with what happened, and I don't have an explanation for them. Was it corrupted, hacked, replaced, I'm not sure.

Has anyone seen this happen? Any ideas why?

[JerrySalem]

Never saw that happen before.

What about the condition of the HD? Is it full?

I know that later versions of server keep an Access log, does Server8.5?

Please post anything you find.

[bruceR]

Was the file accessible using normal file sharing? Are you running any backup utilities?

[SoCalMacDude]

The files were not available through regular file sharing.

There is another guy (high integrity consultant) who manages the server machine - I think he uses Retrospect to back up the backup folder to another drive. Hard drive has 116 Gb available, so that's good.

There is s good FM Server log - I will post when I can access it. This may be the key to understanding what happened.

[Vaughan]

Which version of FM Server -- there is no version 8.5. There is FMS 8.0. Unless the server is really running a copy of FileMaker Pro 8.5 and sharing peer-to-peer?