Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I use TrueCrypt to encrypt sensitive data. And then SugarSync to sync them to the cloud. Today I noticed that - my trucrypt file was gone from my computer - The TrueCrypt option to show my history was cleared - Sugar Sync has no record of my file - And the TrueCrypt file is not in my Recycle Bin

So, potentially someone hacked my machine (I'm doing scans now). But I would like to know if there is a log file in windows or somewhere where I can check if the file was deleted.

Can Anyone point me in the right direction? Thanks

share|improve this question

migrated from security.stackexchange.com May 17 '13 at 19:01

This question came from our site for Information security professionals.

2  
Checking if a file was deleted isn't so much a security concern as a power user concern. You might have better luck with this question on Superuser since the involvement of TrueCrypt is only coincidental. There also isn't really enough info since it depends if you have auditing (most don't) or shadow copy (some do by default) enabled. –  AJ Henderson May 17 '13 at 15:32

1 Answer 1

up vote 1 down vote accepted

Windows 7, as well as any other desktop versions of Windows don't keep track of file operations in log files, unless you've explicitly set them to do so. See answers to Prove that you deleted the file. Obviously, you haven't set such file tracking up, or you wouldn't have asked this question. Meaning, you're in no luck with finding evidence of your file being deleted, but that doesn't necessarily mean you're out of luck.

It's also entirely possible your file is still there, but the file system somehow (improper shutdown while in use, hardware error, losing power,...) lost the reference to it and it doesn't list it among existing files. You should do a file system check to verify this is not the case. Hit Win+R combination on your keyboard, type cmd and hit Return. Then type chkdsk /v /f X: where X is the drive letter assigned to the partition holding your lost file, and follow instructions. If this is your system drive, chkdsk will prompt you if you'd like to run this check on next boot, if not, it might prompt you it'll temporarily unmount the volume. Just hit y and follow instructions.

If file system check won't restore reference to your file, you're out of luck then and the only way to recover your file would be out of an offline backup. Using syncing software (no matter where it stores its copies) shouldn't really be considered as backup, though. They will quite happily overwrite any previously existing files with new revisions, even if the new revisions are corrupt (they'd have no way of knowing that), or (depending on syncing options you chose) even delete already saved copies if they were deleted at the designated syncing source. Considering you said you can't find the file in your SugarSync account either suggests, you were using 1:1 syncing (instead of incremental) which would delete the copied version of the file, like described.

I'm not familiar with SugarSync, and what syncing options they offer, but it's quite usual even with those cloud based backup providers that offer advanced syncing options, that users choose 1:1 syncing for size constraints reasons, trying to keep their use within a certain backup size quota. This is - as is possible you just found out - a really bad approach to storing backups.

share|improve this answer
    
Cool. thanks for the response. –  dbh21 May 17 '13 at 15:59
1  
+1 for noting that Syncing is as useful as Disk Mirroring as wrongly perceived data backup. Attack the original file and its copy goes away by duplication. Sync without versioning = data loss. –  Fiasco Labs May 18 '13 at 14:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.