Data loss can occur when archiving files in the same folder with similar names and the same modified date

Article:TECH140789  |  Created: 2010-09-28  |  Updated: 2011-08-12  |  Article URL
Article Type
Technical Solution


Under rare circumstances during archival of file server data, FSA allocates the same SavesetId to two or more files. The result is that the data content is lost for some of the files. On placeholder recall, all the related placeholders recall just one of the files.

The problem can only occur when all of the following conditions apply:

  • The files are on the same folder path 
  • The files have a modified date (mdate) varying within a range of  ±4 seconds
  • The content of the files is different
  • The files have similar names
  • At least one of the file names include any of the following T-SQL wildcard characters:

_ % [ ] ^   (underscore, percent symbol, square brackets, or circumflex accent)

For example, the problem occurs with the following pairs of files: 


File a File b Mdate of File a  Mdate of File b Notes



17/11/2001 13:29:50

17/11/2001 13:29:54

The hyphen in file a could instead be any single character, for example d, or 9.
In this example the mDate varies by 4 seconds.



12/06/2009 16:32:02

12/06/2009 16:32:02

nnn in file a is any number of characters.
Same mDate.



10/09/1993 10:32:12

10/09/1993 10:32:12

n in file a is any one of the characters that is enclosed by square brackets in file b (1, 2, or 3, in this example). Same mDate.



07/11/1997 14:12:14 

07/11/1997 14:12:15

n in file a is any one character that is not enclosed by square brackets in file b (for example, 4 or y).
In this example the mDate varies by 1 second.



What is affected 

The following versions of Symantec Enterprise Vault are affected: 

  • Any installation of Enterprise Vault for File System Archiving 8.0 SP3 (new or upgraded)
  • Any installation of Enterprise Vault for File System Archiving that has been upgraded to 8.0 SP4
  • Any installation of Enterprise Vault for File System Archiving that has been upgraded to 9.0

Note: New installations of Enterprise Vault 8.0 SP4 and 9.0 (i.e. those that have not been upgraded from a previous version) or versions earlier than 8.0 SP3 are not affected by this issue.

Please see the 'How to determine if Enterprise Vault was upgraded' section.

How to determine if Enterprise Vault was upgraded
For more information please refer to the following article

How to check the history of service packs that have been applied to the Enterprise Vault (EV) server.

How to determine if affected
Symantec is working towards developing a tool that will identify the files and corresponding folder path for potentially affected files that may need to be restored from backup.   Please subscribe to this article by clicking on the "Subscribe via email" link on this page to receive notification when this article is updated with the tool information.

Symantec recommends applying the hotfixes in the Solution section of the article to prevent further data loss from occurring. 


When a second file, matching the criteria described above, is being archived, the corresponding SQL stored procedure incorrectly interprets some of the file name characters as wildcard and reports that the file has already been previously archived. The second file is archived as another version of the first file and is associated with the same Saveset record created for the first file. This causes the corresponding database records to be left in a corrupt state. When the Placeholder shortcut is created, the content stream of the second file is deleted, therefore causing the data loss, and it is set with a Reparse Point associated with the record for the first file. 



This issue is formally resolved in the following Hotfixes. The hotfixes help to ensure the SQL stored procedure correctly interprets the file name characters and new files are archived accordingly.  However, the hotfix will not be able to recover the items that were affected and can only prevent new data from being archived incorrectly. The tool described above will provide following functionality: 

  • Correct the corresponding database records that were affected by corruption.
  • Provide a list of files and corresponding path for items that were previously affected and need to be restored from backup.

Note: The tool may not be able to list all lost files in some circumstances. Following restrictions will apply:

  • The tool will not be able to find files which have been deleted or have had their shortcuts deleted.
  • If DeleteOnDelete is set, and the shortcut of wild character file is being deleted, it will delete the file which has the same reparse point.
  • For moved placeholders the tool will not be able to find the file which has lost data.


Enterprise Vault 8.0 SP3 Hotfix -
Enterprise Vault 8.0 SP4 Hotfix -
Enterprise Vault 8.0 SP5 -  
Enterprise Vault 9.0 Hotfix -

How to Subscribe to Email Notification:
Directly to this Article:
Subscribe to this article by clicking on the "Subscribe via email" link on this page to receive notification when this article is updated with Release Information.

Software Alerts:
If you have not received this TechNote from the Symantec Email Notification Service as a Software Alert, you may subscribe via email and/or RSS using the links provided at the following page:

Symantec Strongly Recommends the Following Best Practices:
1. Always perform a FULL backup prior to and after any changes to your environment.
2. Always make sure that the environment is running the latest version and patch level.
3. Subscribe to technical articles for updates.




Supplemental Materials


FSA - Data Loss - files with 'almost' same name are archived linked to a single SavesetId.

Article URL

Terms of use for this information are found in Legal Notices