Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to check if someone/something deleted files in our server (Microsoft Windows Server 2003 R2) even beyond the deletion in the recycle bin. Is there any way I can view the trace of the deleted files?

The File Shredder claims that Windows leaves a trace when files are deleted:

Actually, the "delete" operation in Windows only removes bits of information from files so they appear deleted in OS. It is easy to retrieve those files using aforementioned specialized file recovery software.

There were also a post that deleted files somewhat leave a trace in the hard disk itself:

Theoretically, I hear you (if you're the CIA) can take an a non-optical microscope to a hard drive and recover quite a bit of what was on it even if it's been overwritten since. Everything on hard disk is 0s and 1s, but if they look at it magnetically they can see that some of the 1s used to be 0s and so on. I don't know how far these skills extend, but I believe the capability exists.

I want to see the file name and the date of deletion of the deleted file, is it feasible?

Please help. Thanks in advance.

share|improve this question

I want to see the file name and the date of deletion of the deleted file, is it feasible?

The referenced recovery techniques might (if the disk clusters haven't been reused) be able to recover the original directory. But I would expect a directory to normally be updated in place, so this seems highly unlikely.

Within Windows: no, unless you had enabled file auditing on the file system (ie. not retrospectively).

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .