0

I permanently deleted a file from my computer. Although I have the data in a later version of the file, I now realize I needed the timestamp on that file to calculate how long it took to generate the data.

Windows has an events log that I've looked at some, but am not very familiar with. Does it record an event when a file is created and when it's permanently deleted? If so, how can I find that information?

Windows 11

Improve this question
2

2 Answers 2

Reset to default
3

To the best of my knowledge, there is no universal event for file deletion. The Event Logs are incredibly cluttered as-is, and adding the thousands of files created and deleted each day would make it worse.

However: it may be possible to use file recovery software to get pertinent information, such as creation date/time, or even to recover the file. When an NTFS file is "deleted", a change is made to the catalog of the file system, and the space on the disk is marked available for reuse, but it is not immediately overwritten. The odds of being able to recover a file decrease with disk use, as that information will eventually be overwritten by another file.

If timestamp information is valuable,

  1. Stop using the drive with that data. Do not install software on that drive.
  2. Make a disk image using an offline tool, such as Macrium Reflect rescue media, installed on another machine, so as to avoid overwriting the data. One could also use a Ubuntu Live USB, using the dd command-line tool to make the image.
  3. Try to recover the data from the mounted disk image. This allows use of the original drive without worry that the data will be overwritten.
Improve this answer
4
  • Thank you for going beyond my question with an alternative solution. Your first link is to EaseUS software. That page warns to install on a different drive. I downloaded the install file to an external drive, opened it, and it did not ask where to install, but went ahead and put its 300 Mb of files on drive C. When I ran it, it gave a folder tree of available files with last-modified times, many two months ago, but the whole folder where the problem deletion occurred a few hours ago is not there. I suppose it was overwritten by EaseUS stupidly installing itself on drive C against my will!
    – NewSites
    May 25, 2023 at 17:13
  • Installing to the C: drive is standard for all Windows apps. The only sure way to prevent that is to install on another machine. Sorry I was not clear about that, and (belatedly), I'm amending the answer.
    – DrMoishe Pippik
    May 25, 2023 at 17:50
  • Installing to C is the default, but most software offers the option to override that. Especially since the instructions specifically warned to not install on the drive at issue, it's very strange that this software didn't offer that option. --- However, see my next comment.
    – NewSites
    May 25, 2023 at 17:54
  • I spoke too soon. I didn't notice the scan was still underway when I first looked. Fortunately, I didn't close the window then, and when I went back later, there was the folder at issue. Strangely, it shows three identical entries for the file I want, same name, time modified, and size. I recovered them all, where I could see the creation times, also all the same. I ran comp on them, and they are all the same. So I don't understand why there are three of them. But anyway, I've got the time for when the file was saved, which is what I needed (not the time it was deleted), so thank you!
    – NewSites
    May 25, 2023 at 18:04
1

Although not my expertise as this tends more towards forensics I did capture some data from the $MFT before deleting a file and after:

enter image description here

Perhaps enough to give some answer to: "I now realize I needed the timestamp on that file to calculate how long it took to generate the data."

The tool I am using is called DMDE, you will only need the free version which can be grabbed at https://www.dmde.com. You can download DMDE on a different PC, copy/unzip it to a pen drive and run it from there without requiring installation.

  • Switch to 'Logical Disk' in disk selection windows
  • Select the drive by drive letter
  • Select top most entry in next window
  • Click 'Open Volume'
  • Click All Found / Virtual FS
  • Leave options as they are, click OK
  • Browse to folder containing the deleted file
  • Select deleted file and Right-Click it
  • Select 'Open Entry (Hex Editor)
  • Expand $Standard Information for the selected file

Now, it may be possible 'accessed' date changed due to me selecting the file in order to delete it rather than the delete event itself. But this you could verify/test yourself by experimenting with a dummy file.

Improve this answer
1
  • Thank you. I got what I needed from EaseUS in the other answer, but it's good to know about this additional resource.
    – NewSites
    May 25, 2023 at 19:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .