Posted: Tue Mar 04, 2014 12:29 am Post subject: File history - how to determine when and who deleted a file
I have a system where a sensitive folder was deleted, it appears that one of our automated systems could have done this but I also have some remote logon activity (legitimate) or it could have been infact a misclicking user.
This is windows XP, so NTFS file system. The data has since been recovered, at least what was not overwritten already.
Does anyone know of a way for me find the file history before or after recovery?
Well I have a time for when the user logged off, the files were there.
Shortly after I have a remote connection from a service desk technician browsing to the PC and replacing some desktop shortcuts.
We have a utility (microsoft delprof) that is a user profile cleanup tool that if it was ran on that day would have deleted the folder in question. That department says it runs on a day other than when the data went missing and the logs show 0 files deleted.
And I also have the forensic tech saying that it is impossible to find out what happened to the files because one of the support techs restored the files that went missing.
Either way it doesn't all add-up properly. Was there 5pm, gone at 8am.
I need to definitively be able to see system deleted it @ 7pm when this tool ran out of its scoped hours or I can see a domain user XY deleting it.
And to determine if it infact a true statement that the evidence was contaminated because of the restore or if it is a limitation with NTFS.
There is lots of finger pointing and it is a district attorneys computer which makes it extra delicate.
Second *edit* hah.
I can see where the delprof2 executable ran @7pm and the folder was in a directory that it would have looked in, compared the foldername to AD saw it as invalid and deleted it.
I now only need to be able to see on the file itself on the HD a timestamp of when it was deleted.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum