1

I want to find out who deleted a specific file from a USB disk.

The disk is formatted as NTFS. The file was deleted while the disk was plugged into a Windows 7 system. However, while I do have possession of the USB disk, I do not have access to that system anymore.

Using forensic techniques, with the presumption that no data was written over the deleted file, is it possible for me to determine who deleted it? Does this change, if there was newer data written over the file or if the culprit attempted to cover his tracks in any way?

Improve this question
7
  • 2
    Who, probably not. When, quite possibly (and this might lead to who by cross-checking with login session history). What operating system, what filesystem on the disk, has the disk been used since then, is there reason to suspect the deleter tried to hide his tracks?
    – Gilles 'SO- stop being evil'
    Jan 8, 2013 at 15:17
  • why are you trying to determine who deleted the file? whats the context of your investigation?
    – Matthew
    Jan 8, 2013 at 15:40
  • 2
    Let me make sure I have the scenario right. You have a USB disk, formatted as NTFS. Someone plugged that disk into a Windows 7 system, and deleted some file(s) from the USB disk. You are now in possession of the USB disk, but do not have access to the Windows 7 system. You want to know who deleted the file. If all of the preceding presumptions are correct, I doubt you'll be able to find your answer without re-gaining access to the Windows 7 system. Even then, depending on the system's auditing configuration and user authentication mechanisms, your chances might not be so great.
    – Iszi
    Jan 8, 2013 at 18:52
  • NOTE: I'm going to roll up all the data from comments into the question. Please re-edit if it is inaccurate.
    – Iszi
    Jan 8, 2013 at 18:56
  • Yeap that sums it up pretty much Iszi. MP: I am trying to determine who deleted an important file from a USB disk because there was no backup at the time. I know the machine was win 7 for the stick was in the company all the time but not the specific computer.
    – Athanasios Kataras
    Jan 8, 2013 at 19:20

1 Answer 1

Reset to default
4

No, there is no way to know who deleted the file by looking at the USB stick alone. Even if there was a way it would be very easy to modify the content of the USB stick to mask this behavior. If you have access to the machine then you can configure windows to log file deletion events. However, even windows log files can be modified.

Improve this answer
4
  • Answer accepted but please explain why - Is this because the usb drive itself has no logging information about the user? So the only way to find it is to pinpoint the exact pc and hope logging is enabled. Thank you very much.
    – Athanasios Kataras
    Jan 9, 2013 at 8:02
  • @Thanos K. well NTFS doesn't log this type of information, this file system is about saving space wherever possible. Most people don't care about this level of logging, they care about more storage.
    – rook
    Jan 9, 2013 at 15:36
  • @Rook you mention that NTFS does not log this, could you name a fs that keeps track of the access? I am trying to discover what a device is looking for when I connect a usb stick to it, and read the device's "fingerprint"
    – olamotte
    Dec 13, 2013 at 16:27
  • @olamotte This is not the role of a filesystem, but an application can use a filesystem to perform this action.
    – rook
    Dec 13, 2013 at 17:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .