Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Compare two jobs to see which files were changed / deleted?

Created: 18 Jun 2013 • Updated: 19 Jun 2013 | 3 comments
This issue has been solved. See solution.

What method can I use to compare two completed jobs to find out what files changed between jobs.  One job shrank 10GB and I need to track down whodunnit.

Thanks

FYI - Logging was set to detailed but I had a problem recently where backup job logs were corrupting and change logging to minimal. So th ejob log is not goin gto be much help here.

Operating Systems:

Comments 3 CommentsJump to latest comment

lmosla's picture

Hi  You could create restore jobs and then expand the dates of the suspect job to compare files.

also were these both the same job types?  Incremental vs full  etc? 

pkh's picture

You can dump out your catalogs using CatTools and hence use a compare utility to compare the results.  You can get CatTools here

http://www.symantec.com/docs/TECH136392

SOLUTION
FNDAdmin's picture

Thanks PKH!!

Cattools was the way to go.

I created a BAT program to run CatTools on all 40+ .FN files then grabbed the ones that showed changes and imported them into Access and ran a simple find changes query.

Ended up that I had a user that did a fair amount of house keeping on their home drive, 10GB worth. Just wanted to make sure is wasn't a disgruntled employee on their way out the door deleting all that they had access too...

  Too bad there isn't a GUI for this tool or something built into BENT.

Thank you for your help!

@mlosla, Your solution would have worked too if I had several terabytes free to restore the backup job to twice and several hours to wait for it to complete.