0

I want to check if someone/something deleted files in our server (Microsoft Windows Server 2003 R2) even beyond the deletion in the recycle bin. Is there any way I can view the trace of the deleted files?

The File Shredder claims that Windows leaves a trace when files are deleted:

Actually, the "delete" operation in Windows only removes bits of information from files so they appear deleted in OS. It is easy to retrieve those files using aforementioned specialized file recovery software.

There were also a post that deleted files somewhat leave a trace in the hard disk itself:

Theoretically, I hear you (if you're the CIA) can take an a non-optical microscope to a hard drive and recover quite a bit of what was on it even if it's been overwritten since. Everything on hard disk is 0s and 1s, but if they look at it magnetically they can see that some of the 1s used to be 0s and so on. I don't know how far these skills extend, but I believe the capability exists.

I want to see the file name and the date of deletion of the deleted file, is it feasible?

Please help. Thanks in advance.

1

There were also a post that deleted files somewhat leave a trace in the hard disk itself

Deleted files leave a whole lot more than a trace.

Since this question is tagged this answer assumes use of the NTFS filesystem.

When you "permanently" (i.e. from the Recycle Bin) delete a file in the Windows operating system, Windows doesn't delete the entire file. Instead, it simply removes references to the file from the Master File Table (MFT), which acts as an "index" used by the filesystem to locate the file's actual data. From MSDN:

There is at least one entry in the MFT for every file on an NTFS file system volume, including the MFT itself.... When files are deleted from an NTFS file system volume, their MFT entries are marked as free and may be reused.

That's all that happens. The actual data is left on the disk. With the proper tools these files can be easily recovered, so long as some other file hasn't had its data saved over top of the deleted data.

0

I want to see the file name and the date of deletion of the deleted file, is it feasible?

The referenced recovery techniques might (if the disk clusters haven't been reused) be able to recover the original directory. But I would expect a directory to normally be updated in place, so this seems highly unlikely.

Within Windows: no, unless you had enabled file auditing on the file system (ie. not retrospectively).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.