Data Recovery · LanCologne

What should you bear in mind if an Active Directory database is damaged (NTDS.dit/SYSVOL)?

The NTDS.dit file contains the Active Directory database of a domain controller, including users, groups, computers and password hashes. SYSVOL contains Group Policy settings and logon scripts. If both are corrupted on the sole domain controller, logon to the network will be prevented.

Free enquiry

Technical background

NTDS.dit is an ESE database containing transaction logs (edb*.log). Following a crash, it may be in an inconsistent state („dirty shutdown“). If there are other domain controllers, recovery via replication is often the better option. With a single DC, the choice is between a system state backup or restoring the database files.

What you should – and shouldn’t – do now

  • No „esentutl /p“ (Hard Repair) on the original file – this may cause records to be discarded.
  • Check whether there are any other domain controllers or a system state backup.
  • In the event of a ransomware attack: isolate the domain controllers and carry out a forensic backup.

Here’s how we do it

  • Backing up the domain controller’s storage medium or virtual machine.
  • Extraction of NTDS.dit, transaction logs and SYSVOL.
  • Consistency check and recovery on a copy.
  • Handover to your IT department or service provider for reintegration.

Borders

  • Missing transaction logs may result in data loss relating to recent changes.
  • Your administrators will be responsible for bringing the directory service back online; we will supply the data.

Possible results

Recovered database and SYSVOL files in a consistent state, as far as technically possible.

How we carry out data recovery

Every data storage device is first diagnosed in our own laboratory in Cologne; the diagnosis is free of charge. You will then receive a written quote and can decide whether to accept it. If you decline, you can collect the data storage device from the laboratory by appointment – there are no postage costs involved – or we will post it back to you; in which case postage and packaging costs may apply. Data is recovered from copies, not from the original – using professional data recovery hardware such as the PC-3000. If a drive needs to be opened, this is carried out on a HEPA H14-filtered clean bench. We do not offer a guarantee of success prior to diagnosis, as this is simply not possible in a professional context. Your storage device and your data will remain confidential and will not be passed on to third parties.

1Enquiries and submission by post or in person at the laboratory by prior appointment
2Free diagnosis of the cause of the damage
3Written quotation – we will only proceed once you have approved it; if you decline, you may collect the item from the laboratory or we will return it to you (postage and packaging costs may apply)
4Recovery, data verification and confidential handover

Request a diagnosis   Find out more about the process, costs and confidentiality →

Frequently Asked Questions

Is it enough just to set up a new DC?+
If there are other DCs with an intact database, then yes. With a single DC, all objects will be lost unless they are recovered.
Is NTDS.dit relevant to security?+
Yes. It contains password hashes and is treated as confidential.
Can a compromised domain controller be recovered?+
The data can be recovered; whether the system is trustworthy must be assessed through forensic analysis following an attack.

Related topics

🔗 Related topics