Finding out what has been deleted

SPECIALBLEND218 · 15-September-04, 11:25 AM

Today we had an employee quit and someone has repoted that he has deleted some valuable data (or at least tried) that we have paid him to create (since thats his job). I want to know if there are any good programs or methods that can tell us what he deleted and when. I don't need to recover the data since it's all back up to the server (brownie points for me when I told the boss that, since he was worried). But I need to know what files he has deleted (or at least tried).

Thanks guys for the help.

turbopsi · 15-September-04, 12:26 PM

If you ran a data recovery program, wouldn't that tell you what he deleted? Otherwise, I don't know, I never was in that situation.

TekXoID · 15-September-04, 12:34 PM

TuneUp Undelete will list pretty much every deleted file that has not been overwrited or put through a file shredding program. I think you can get a trial here

Joose · 15-September-04, 12:36 PM

You can run a compare between the restored directories and the existing directories. Unfortunately, you need to have the logger RUNNING to capture what he did while he was on the network.

unholy · 15-September-04, 12:55 PM

Just about any data recovery program will list the deleted files (unless they have been overwritten) as well as the deletion date. Just run a search for "undelete" on cnet dowloads.

Joose · 15-September-04, 01:16 PM

Depending on a lot of factors you might not have much luck with an undelete program.

If the files were on a server, (likely) and the server has a high load (also likely) it's very likely that those files have been overwritten. Not only that, but running an undelete on a server will bring back everything, not just something a specific user removed. It will likely take a helluva long time to complete, not to mention the server may have to go offline to run the undelete program. You may also run into licensing issues, as freeware often will not run on a server OS.

Just some things to think about.

To save time, energy and a possible server outage, I'd just restore from tape, to a different location and use robocopy from the Windows Server Resource Kit to compare the two directories, and see what was deleted. Check the help on robocopy to see how.

15-September-04, 11:25 AM	#1 (permalink)
SPECIALBLEND218 H2'Hoe' Cooling Addict Join Date: Jul 2003 Location: Hesperia, Ca Posts: 1,584	Finding out what has been deleted Today we had an employee quit and someone has repoted that he has deleted some valuable data (or at least tried) that we have paid him to create (since thats his job). I want to know if there are any good programs or methods that can tell us what he deleted and when. I don't need to recover the data since it's all back up to the server (brownie points for me when I told the boss that, since he was worried). But I need to know what files he has deleted (or at least tried). Thanks guys for the help. __________________ www.RevelationLAN.com Southern California's monthly LAN!!!

15-September-04, 12:26 PM	#2 (permalink)
turbopsi Supe-Hoe-Charged Join Date: Jun 2004 Location: Birmingham, Alabama Posts: 1,737	If you ran a data recovery program, wouldn't that tell you what he deleted? Otherwise, I don't know, I never was in that situation. __________________

15-September-04, 12:36 PM	#4 (permalink)
Joose Joosey Join Date: May 2003 Location: Milton, Ontario Posts: 5,537	You can run a compare between the restored directories and the existing directories. Unfortunately, you need to have the logger RUNNING to capture what he did while he was on the network. __________________ Joose - joosy since 1975 Cheap, Good, Fast - You can only have two out of three.

15-September-04, 12:55 PM	#5 (permalink)
unholy Un-Hoe-ly Join Date: Mar 2004 Posts: 420	Just about any data recovery program will list the deleted files (unless they have been overwritten) as well as the deletion date. Just run a search for "undelete" on cnet dowloads. __________________ 100% Dremel-Free Moddin'

15-September-04, 01:16 PM	#6 (permalink)
Joose Joosey Join Date: May 2003 Location: Milton, Ontario Posts: 5,537	Depending on a lot of factors you might not have much luck with an undelete program. If the files were on a server, (likely) and the server has a high load (also likely) it's very likely that those files have been overwritten. Not only that, but running an undelete on a server will bring back everything, not just something a specific user removed. It will likely take a helluva long time to complete, not to mention the server may have to go offline to run the undelete program. You may also run into licensing issues, as freeware often will not run on a server OS. Just some things to think about. To save time, energy and a possible server outage, I'd just restore from tape, to a different location and use robocopy from the Windows Server Resource Kit to compare the two directories, and see what was deleted. Check the help on robocopy to see how. __________________ Joose - joosy since 1975 Cheap, Good, Fast - You can only have two out of three.

15-September-04, 12:34 PM	#3 (permalink)
TekXoID Banned Join Date: May 2003 Location: looking for love in the nearest gay bar Posts: 4,089	TuneUp Undelete will list pretty much every deleted file that has not been overwrited or put through a file shredding program. I think you can get a trial here

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
deleted partitions, how to recover?	AMD-playa	Windows OS Problems	6	13-September-06 02:44 PM
I deleted coffin xp	staff94	Case Modding	1	01-April-04 11:54 PM
Get Deleted Files	Dimazz	Windows OS Problems	2	22-January-04 02:49 PM
Anyones posts getting deleted?	m3_tw0	Anything Goes	2	22-September-03 12:28 AM
Was the thread deleted	DedEye	Anything Goes	0	15-April-03 05:02 PM