I work for a small company (~20 people) and end up doing most of the server/network/everything computer related work since I have a bit of previous experience, but this goes completely above my head so I could use some help! Sorry for the long post, I have no idea what's going on so I figure background information will be useful.
We have an FTP server set up, though we only use it as a fileserver. It's pretty old and running windows server 2008 r2. Originally, our space requirements were low so I'd run a hardware RAID1 array with cloud backup and alternating nightly backups to external hard drives. When we needed more space, I rebuilt the RAID array with larger drives.
However, recently we decided to go with a 10tb RAID1 setup. I originally thought that it would be an easy process, but completely forgot that you can't migrate MBR to GPT and that the old computer without UEFI couldn't boot off the 10tb GPT in the first place, even if I converted and cloned our smaller one.
I ended up making the 10tb hard drives mirrored data drives and simply copying everything from our shared folder over to a new folder on the new hard drive. I used partition manager to mirror since hardware RAID wouldn't recognize a drive that large and neither would windows RST. I then copied our shared folder over with xcopy to preserve permissions. At some point, I started running into ownership issues that were more trouble than they were worth, so I copied the rest manually and then set the permissions myself.
Everything worked fine for about two days. I came in that day and someone said that the server had "disappeared" instantaneously while they were using it. The hard drive only had the one shared folder and nothing else on it originally. When I went and checked, folders from A-D alphabetically had been moved from the "server" folder into the top level of the hard drive. The server folder itself had only the two files that were open the moment it happened left on it. According to my coworkers, this happened literally instantaneously. The files aren't hidden and appear to be actually deleted, as the hard drive itself is nearly empty. Despite extensive logs present on the server computer, I found no record of anything happening or being deleted (and frankly deleting 2 terabytes of information wouldn't happen instantaneously anyway). All of the shadow copies in the previous tab were gone except for the two newest ones, which were from after the issue. The original hard drive and server folder were unaffected.
I didn't understand what had happened, but restored from one of my external backups and hoped it was some kind of fluke. For about a week, it worked normally. Then, this morning, the EXACT same thing happened. A-D in the top folder, everything else completely gone. What is going on here?! Does it have something to do with permissions? The mirrored 10TB drives?
Any help would be greatly appreciated.