It sounds like someone restored a backup to the server, or someone simply went into the machine and deleted the data. Can you be more specific about what kind of data this was? Files on a network share, SQL database files, etc. _____ It does sound like someone restored to a previous time. If they used system restore that would not delete data nor revert the date of the system. If you had a image on the system that could be restored than this would make sense. Someone had to use a recovery tool to reimage the machine unless it was all done maliciously. I would check the event logs for more details. Post any suspicious log entries and we will take a look at it. Was it all the data on the server or was it localized to specific folders?

It sounds like someone restored a backup to the server, or someone simply went into the machine and deleted the data. Can you be more specific about what kind of data this was? Files on a network share, SQL database files, etc. _____ It does sound like someone restored to a previous time. If they used system restore that would not delete data nor revert the date of the system. If you had a image on the system that could be restored than this would make sense. Someone had to use a recovery tool to reimage the machine unless it was all done maliciously. I would check the event logs for more details. Post any suspicious log entries and we will take a look at it. Was it all the data on the server or was it localized to specific folders?