Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My Files got deleted by any Employee . How to find what time it happened and whether done from another computer on network ? The files were in shared drive in the computer. I am using windows 8. What are best tools to recover the files.

share|improve this question
2  
This is a task for a professional, which may take several days of investigation, and you may or may not be able to find the answer in the end, depending on the security controls you have in place. We really can't help you. We can help with focused questions, such as “how do I reconstruct the pieces I've obtained with X forensic tool” or “what does this log entry mean”. We can't help with this general “I need to build bridge, what's the best way?” question. –  Gilles Jun 14 '13 at 12:22
add comment

closed as not a real question by Adnan, Gilles, Terry Chia, AJ Henderson, TildalWave Jun 14 '13 at 15:32

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

First of all, in such cases stop using the network drive. Deleted files are not immediately lost but just marked as "this space can be reused". If no need of additional space presents itself, a file may be fully recoverable years later. On the other hand, if a new file needs to be created and requires space, the deleted file area might be overwritten after a few seconds.

So, the less you write to the drive, the better.

The first line of defense should have been a full, adequate and updated backup. A file is deleted -- you just laugh it off and recover the file from the repository.

Second line of defense, before blaming someone's malice, be sure to rule out inexperience and clumsiness. The file might have been unwittingly dragged and dropped on a nearby folder by someone trying to open it with a double click. Weird, but I've seen that happen. So first of all, unless you already tried, try running a search for the file name in the whole drive.

As a last stand, if the file was indeed deleted, recovery depends on the file system on the network drive, while logging capability depends on its operating system.

For example: if the network drive is on a Windows system, NTFS - if you were sharing a folder in your own computer - then you might be able to easily recover the file using Recuva or any of several "undelete" utilities. If you're in luck, the Shadow Copy facility is activated and you will be able to directly access "Previous versions of this directory" from the Explorer interface on the server (you can't do that from the network, AFAIK).

On these systems, though, it is unlikely that logging facilities are running, especially with the level of detail you would need to have a culprit.

If it is a Linux system, recovery is usually more difficult (you'll need an ext* undelete tool - assuming the filesystem is EXT3/EXT4; undelete support for EXT3/4 is more complicated than in NTFS), but chances are that the file sharing system is Samba and both access times and maybe even operations (logged on a per-workstation basis) are available in the Samba logs. Here for example is a connection from my PC to my home server some time ago:

zotac (::ffff:192.168.4.24) connect to service public initially as user
lserni (uid=1000, gid=100) (pid 11642) [2012/05/03 17:20:07.499617,  1]

The workstation name (zotac), its IP address and the username are all logged. It is possible, but not the default since log files tend to grow huge, to log file-level operations (create, rename, delete).

Other possibilities are trying to locate old versions of the file, and verifying that the employee - if he did the deed with malice and forethought - has accessed or copied the file on his own workstation (just check Recent Files and Documents). I witnessed a case where an employee had copied the whole customers' archive on a USB key before attempting to overwrite the master database on the server. It was never clear whether he intended to hold the database for ransom, or he maybe planned to sell it to some competitor (in the end the PTB agreed on a "good faith mistake" and "let" the employee resign for reasons of health).

share|improve this answer
2  
I'm curious as to why you say recovering files from an ext filesystem is harder than from NTFS? –  lynks Jun 14 '13 at 9:21
1  
The main reason is - from an end-user's point of view - the dearth of undelete tools for EXT3/EXT4 (but I've added a link); but actually, EXT3 allocation strategy seems to make recently freed space more likely to be reused. More importantly, crash resistance for unlink operations ( batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html ) requires an unlink to do much more damage that in NTFS, let alone FAT32. Things get better with EXT4, but I have next to no experience on that one. Much would depend on the file's position on the disk, too. –  lserni Jun 14 '13 at 16:53
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.