Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

FYI... Best undelete tool for NTFS/FAT? and I need program for recover deleted files in windows mention NTFS undelete to recover deleted files. BUT...

I believe my computer may have been hacked. Is there a way to check history in Windows to see if a file was deleted or maybe it was cut and pasted on an external drive. Either way, knowing when the change occurred would be very beneficial.

share|improve this question
up vote 1 down vote accepted

I doubt it will have the information you need, and I'm not sure if it works for deleted files, but your best hope is probably:

FSUtil USN ReadData C:\My\Path\To\File.txt

Other than that, Windows does not log file operations.

share|improve this answer
It "Error: The System cannot find the file provided". Looks like a no-go for deleted files. Other ideas? – csi May 16 '11 at 1:17
@Christopher: Nope, sorry. :( Windows doesn't log file operations, so I'm not sure if the data you want exists at all unfortunately. – Mehrdad May 16 '11 at 1:55

You do not give rasons for 'being hacked'. Slow? There are many freeware programs on the internet for undeleting. Check MAJORGEEKS.COM or FILEFORUM.COM ... they always have the very latest, with reliable trustworthy descriptions & user feedback.

Get "Malicitious Removals" software from the MS web site. It is updated every few weeks.

B4 it starts booting into Windows, hold down the 'F8' key. This will present you with choices. Select SAFE BOOT. You can run any virus scanning program on the hard disk from here.

Whilst there, check: RUN 'CMD' Then 'msconfig'

You can see what is booting when you are not in safe mode. Unselect all or some of the non-Ms programs. It it works, this will narrow down your problems.

Majorgeeks et al, will give you a freeware Linux-based virus checker.

There is another inbuilt Windows command to check that your MS Windows original files are as originally designed. But I was not able to find it yet - you already have it there.

Often 'errors' might mean that you need to run 'chkdsk x: /f' - where 'x' is the drive that contains the Windows NTFS disk errors. You can also do this from within Windows on the Windows boot partition.

'COMPUTER' [right click], or open. Select drive C. [right click] on Drive C. 'Properties'. 'Tools. Check Now.

This will schedule a complete check on the next restart of the Windows op sys drive.

share|improve this answer
Thanks and I apologize for not being clear. I believe someone hacked my cpu password and stole the files directly from my machine with a usb drive. Not too happy about it. – csi May 16 '11 at 4:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .