I want to check if someone/something deleted files in our server (Microsoft Windows Server 2003 R2) even beyond the deletion in the recycle bin. Is there any way I can view the trace of the deleted files?
The File Shredder claims that Windows leaves a trace when files are deleted:
Actually, the "delete" operation in Windows only removes bits of information from files so they appear deleted in OS. It is easy to retrieve those files using aforementioned specialized file recovery software.
There were also a post that deleted files somewhat leave a trace in the hard disk itself:
Theoretically, I hear you (if you're the CIA) can take an a non-optical microscope to a hard drive and recover quite a bit of what was on it even if it's been overwritten since. Everything on hard disk is 0s and 1s, but if they look at it magnetically they can see that some of the 1s used to be 0s and so on. I don't know how far these skills extend, but I believe the capability exists.
I want to see the file name and the date of deletion of the deleted file, is it feasible?
Please help. Thanks in advance.