3

FYI... https://superuser.com/questions/6810/best-undelete-tool-for-ntfs-fat and https://superuser.com/questions/8297/i-need-program-for-recover-deleted-files-in-windows mention NTFS undelete to recover deleted files. BUT...

I believe my computer may have been hacked. Is there a way to check history in Windows to see if a file was deleted or maybe it was cut and pasted on an external drive. Either way, knowing when the change occurred would be very beneficial.

2 Answers 2

1

I doubt it will have the information you need, and I'm not sure if it works for deleted files, but your best hope is probably:

FSUtil USN ReadData C:\My\Path\To\File.txt

Other than that, Windows does not log file operations.

2
  • It "Error: The System cannot find the file provided". Looks like a no-go for deleted files. Other ideas?
    – csi
    May 16, 2011 at 1:17
  • @Christopher: Nope, sorry. :( Windows doesn't log file operations, so I'm not sure if the data you want exists at all unfortunately.
    – user541686
    May 16, 2011 at 1:55
0

You do not give rasons for 'being hacked'. Slow? There are many freeware programs on the internet for undeleting. Check MAJORGEEKS.COM or FILEFORUM.COM ... they always have the very latest, with reliable trustworthy descriptions & user feedback.

Get "Malicitious Removals" software from the MS web site. It is updated every few weeks.

B4 it starts booting into Windows, hold down the 'F8' key. This will present you with choices. Select SAFE BOOT. You can run any virus scanning program on the hard disk from here.

Whilst there, check: RUN 'CMD' Then 'msconfig'

You can see what is booting when you are not in safe mode. Unselect all or some of the non-Ms programs. It it works, this will narrow down your problems.

Majorgeeks et al, will give you a freeware Linux-based virus checker.

There is another inbuilt Windows command to check that your MS Windows original files are as originally designed. But I was not able to find it yet - you already have it there.

Often 'errors' might mean that you need to run 'chkdsk x: /f' - where 'x' is the drive that contains the Windows NTFS disk errors. You can also do this from within Windows on the Windows boot partition.

'COMPUTER' [right click], or open. Select drive C. [right click] on Drive C. 'Properties'. 'Tools. Check Now.

This will schedule a complete check on the next restart of the Windows op sys drive.

1
  • Thanks and I apologize for not being clear. I believe someone hacked my cpu password and stole the files directly from my machine with a usb drive. Not too happy about it.
    – csi
    May 16, 2011 at 4:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .