sync: auto-sync from GURU-5070 at 2026-07-21 18:52:18

Author: Mike Swanson
Machine: GURU-5070
Timestamp: 2026-07-21 18:52:18

clients/peaceful-spirit/session-logs/2026-07/2026-07-21-mike-corrupt-file-batch-recovery-staging.md

@@ -0,0 +1,105 @@
+## User
+- **User:** Mike Swanson (mike)
+- **Machine:** GURU-5070
+- **Role:** admin
+
+# Peaceful Spirit — Corrupt-File Batch Recovery + Staging for Mara
+
+**Date:** 2026-07-21 · **Client:** Peaceful Spirit Therapeutic Massage · **Host:** PST-SERVER (via GuruRMM agent 87293069-33b6-45e8-a68f-6811216cdb96)
+
+## Session Summary
+
+Revisited the June-2025 crash corrupt-file recovery. First reviewed the earlier carve recovery: the 4
+hand-recovered payroll xlsx (IC Payments 2-12 to 2-26-25, Payroll Report 4-29 to 5-12-2025, Tips Report
+12-30 to 1-12-25, Triwest & Insurance 2024-11-15) were still staged untouched at `C:\PST-Recovery\carve-identified\`.
+Validated all 4 by opening them as xlsx archives and reading the actual sheet names + cell content — confirmed
+genuine, intact workbooks (the IC Payments file Mara chased for a year has the expected per-therapist Chk-report
+tabs and QB/mgmt-fee columns).
+
+Per Mike, then tackled the ENTIRE corrupt pool across Private + Scanned. Scoped it: 5,037 real `[C]`-corrupt
+files (Private 5,025, Scanned 12; ~2.83 GB; 4,858 PDF, 108 xlsx, 24 docx, images). Carve source `D:\Unknown folder`
+= 140,734 files / 261 GB. First tried exact-size carve matching — only 417/5,037 (poor). Then tried exact-path
+matching in `D:\Shares` — failed (folder structure was reorganized between the crash-era snapshot and current
+share). Then filename matching + magic-byte validation across all D: corpora — the winning method.
+
+Built a recovery plan: for each corrupt file, found every same-named copy across `D:\Shares` + `D:\Recovery-EXT`
++ `D:\Recovery2019` + carve pool, kept only ones with a valid header (`%PDF`/`PK`/JPEG…), rejecting the MPEG
+(`00 00 01 BA`) corrupt copies; carve-by-size as fallback. Result: **1,569 recoverable** (1,434 named-copy, 135
+carve) + the 4 payroll = **1,573**; **3,468 not recoverable** (every surviving copy corrupt). Staged the 1,573
+to `C:\PST-Recovery\staged-for-mara\` (mirror layout, clean names, 957 MB), spot-checked 12 random staged files
+(all valid, 0 corrupt), then copied the whole tree into the share at `G:\Shares\Private\_RECOVERED-for-review\`
+so Mara can browse it normally, with a manifest, a not-recoverable list, and a README. The live share was NOT
+modified — the corrupt `[C]` originals remain in place pending Mara's sign-off.
+
+## Key Decisions
+
+- Method progression: exact-size-carve (417) -> exact-path-in-D:Shares (failed, reorg) -> **filename + magic-byte
+  validation across all D: corpora** (1,569). Magic validation is essential — many same-named copies are also
+  corrupt (corruption predates the backups for a subset).
+- Left the 4 payroll files as their own hand-validated carve recoveries (ambiguous by size, needed content
+  scoring) rather than forcing them through the automated size-match; folded them into the review tree at their
+  correct mirror locations afterward.
+- Staged to a review folder UNDER the share (per Mike) rather than server C:, so Mara accesses it via normal
+  share browsing; kept the live share untouched until she approves the go-live replacement.
+- Ran all analysis read-only; the only writes were the staging copies (to C: staging, then to the new review
+  folder) — no existing client file changed.
+
+## Problems Encountered
+
+- **Exact-size carve match too narrow (417/5,037)** — the carve pool wasn't the primary source; structured D:
+  backups are. Fixed by switching to filename+magic matching.
+- **Exact-path matching failed** — D:\Shares folder structure reorganized vs current G:\Shares. Fixed by matching
+  on filename anywhere in the corpora.
+- **Many D: copies also corrupt** — verified each candidate's magic bytes; picked the valid survivor when one
+  existed; else marked not-recoverable.
+- **RMM Start-Process launcher commands reap** (RMM timeout) but the detached job still launches and runs — read
+  results from the summary/CSV files it writes, not the launcher's return.
+- **Missed the mandatory #dev-alerts post** after RMM write ops (staging copy); Mike prompted. Posted it and
+  logged the miss as `--friction` (rmm/dev-alert). Rule: every RMM write/dispatch posts a `[RMM]` one-liner.
+
+## Configuration Changes
+
+- **PST-SERVER** — created `G:\Shares\Private\_RECOVERED-for-review\` (958 MB, 1,573 recovered files + manifest +
+  not-recoverable list + README). New folder only; no existing files modified. Note: this replicates via DFS-R to
+  PST-DC-NW (adds ~958 MB to the PST-DFS sync — negligible vs the ~265 GB initial sync).
+- Staging + artifacts on PST-SERVER C:\PST-Recovery: `staged-for-mara\`, `STAGING-MANIFEST-*.csv`,
+  `NOT-RECOVERABLE-*.csv`, `recovery-plan-*.csv`, `match-plan-*.csv`, plus the `_matchplan/_recoveryplan/_staging`
+  builder scripts + logs.
+
+## Credentials & Secrets
+
+None new. PST-SERVER access via GuruRMM agent 87293069-33b6-45e8-a68f-6811216cdb96 (no VPN needed).
+
+## Infrastructure & Servers
+
+- **PST-SERVER** 192.168.0.2 (Server 2016 Essentials, all-FSMO DC). G: = data volume (old server's C:; frozen D:
+  = 2025 crash recovery corpus). Recovery corpora on D:: `D:\Shares` (crash-era tree, reorganized structure),
+  `D:\Recovery2019`, `D:\Recovery-EXT` (2021 ownCloud), `D:\Unknown folder` (140,734 file-carving outputs).
+- Corrupt-file signature: valid name/size, foreign data blocks — MPEG-2 pack header `00 00 01 BA` is the tell.
+  Mike's `[C]` filename prefix marks confirmed-corrupt files.
+
+## Commands & Outputs
+
+- Scope: 5,037 real `[C]` files (Private 5,025 / Scanned 12), 2.83 GB. Carve pool 140,734 files (54,277 sizes).
+- Match methods: exact-size carve 281 unique + 136 multi; filename+magic recovery **1,569** (named-copy 1,434,
+  carve 135); NOT recoverable 3,468.
+- Staging: copied 1,573 (0 failed), 957 MB -> `C:\PST-Recovery\staged-for-mara\` -> `G:\Shares\Private\_RECOVERED-for-review\`.
+- Validation: 12/12 random staged files valid (`%PDF`=25504446, `PK`=504B0304); 0 corrupt. C: free 693 GB.
+
+## Pending / Incomplete Tasks
+
+- **Mara reviews `G:\Shares\Private\_RECOVERED-for-review\`** and signs off. Then ACG replaces the corrupt `[C]`
+  originals with the recovered copies (a separate approved go-live step — writes to live HIPAA data).
+- **3,468 not-recoverable files** — every surviving copy corrupt; business/records decision. For specific
+  high-value ones Mara flags, the content-scoring carve method (as used on the 4 payroll files) can be tried
+  individually — not practical across thousands of PDFs.
+- The 5th payroll file `IC Payments 5-13 to 5-27-25` remains unrecovered (content = ownCloud log; Mara has a
+  partial manual rebuild).
+- After go-live: clean `C:\PST-Recovery` staging (~1 GB) and confirm DFS-R absorbed the review-folder replication.
+
+## Reference Information
+
+- Review folder (Mara): `G:\Shares\Private\_RECOVERED-for-review\` (or via `\\PEACEFULSPIRIT.local\PST-Files\Private\_RECOVERED-for-review`).
+- Manifest: `RECOVERY-MANIFEST.csv`; lost list: `NOT-RECOVERABLE-LIST.csv`; guide: `_READ-ME-FIRST.txt`.
+- Wiki: `wiki/clients/peaceful-spirit.md` (2025 Crash & File Corruption section). RMM agent 87293069-...
+- Dev-alert posted to #dev-alerts (msg 1529304774002868347).