Deleting Files

[stlpnazi]

If I delete a file from a shared folder on a server (Windows NT or Server 2000), where does it go? I know it doesn't go into the recycle bin on the local machine from which it was deleted. Does it go into the recycle bin on the server? If so, on which user profile?

Additionaly, does anybody know of a program that will track who deleted what on a server joined to a domain? If you can't tell, at my place of employment we have had issues with users deleting files, and not only do we want to recover them but we want to be able to find out who did it.

Any help is greatly appreciated. Thanks!

 

[root]

question 1, where doesit go?
nowhere, it just disapears into the ether, it's irretreivably lost.
the only way to restore is either from a backup, or from some kind of disk forensic restoration process... (I.e either buying specialist recovery software, or sending the disk to someone who'll examin the platters.) if you know that the forensic route is the only way to go then I suggest that you stop using the disk now.
each time a file is erased it is not the file that is erased, just the pointers to the file in the file allocation table on the disk, the more the disk is used after the critical file has been deleted the morechance newly flagged free space (containing the file you want) will be written over with a new file which you may or may not want.

as for the second question, How can I monitor who has acces and who is doing what to which files?
windows doesn't seem to have any built in tools to monitor file sharing, so again there seems to be no way...
I'm less adement about this one though, somewhere out there there must be some tools to do it.

 

[stlpnazi]

Thank you for the reply. Its amazing how many users on our network actually accidently hit delete on a shared file and accidently confirm it. I was seeing if there was any way to recover it without an external progarm. Thanks again.

Does anybody know of any good monitoring software for server shares?