Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My sister told me that her windows XP account has been reset but she did not reset it personally. By reset, I mean all her documents and settings are gone but the account still exists. She is not sure if this is a virus or if one of her friends have done it as a prank without realizing that everything would be gone forever.

Is there a way to find out what happened using event viewer or some other logging mechanism?

Thanks

share|improve this question
    
I don't know about how to find out, but I believe that resetting your password (as opposed to changing your password) can cause this deletion. –  Hand-E-Food Sep 25 '12 at 5:51
    
look in the users folder and inside every username folder that you see if you dont see your files anywhere inside then its gone. You can also try restoring that might bring things back. –  Sarmen B. Sep 25 '12 at 6:53
    
I use the create date of the user folder as my indicator. If it's a significant time in the past, then you're looking at a possible Windows restore that was done. –  user3463 Sep 25 '12 at 15:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.