Today we had an employee quit and someone has repoted that he has deleted some valuable data (or at least tried) that we have paid him to create (since thats his job). I want to know if there are any good programs or methods that can tell us what he deleted and when. I don't need to recover the data since it's all back up to the server (brownie points for me when I told the boss that, since he was worried). But I need to know what files he has deleted (or at least tried).

Thanks guys for the help.

If you ran a data recovery program, wouldn't that tell you what he deleted? Otherwise, I don't know, I never was in that situation.

TuneUp Undelete will list pretty much every deleted file that has not been overwrited or put through a file shredding program. I think you can get a trial here

You can run a compare between the restored directories and the existing directories. Unfortunately, you need to have the logger RUNNING to capture what he did while he was on the network.

Just about any data recovery program will list the deleted files (unless they have been overwritten) as well as the deletion date. Just run a search for "undelete" on cnet dowloads.

Depending on a lot of factors you might not have much luck with an undelete program.

If the files were on a server, (likely) and the server has a high load (also likely) it's very likely that those files have been overwritten. Not only that, but running an undelete on a server will bring back everything, not just something a specific user removed. It will likely take a helluva long time to complete, not to mention the server may have to go offline to run the undelete program. You may also run into licensing issues, as freeware often will not run on a server OS.

Just some things to think about.

To save time, energy and a possible server outage, I'd just restore from tape, to a different location and use robocopy from the Windows Server Resource Kit to compare the two directories, and see what was deleted. Check the help on robocopy to see how.