Go Back   Computer Forums > General Computing > Server Administration
Click Here to Login
Join Computer forums Today


Reply
 
Thread Tools Search this Thread Display Modes
 
Old 05-22-2005, 10:18 AM   #1
Baseband Member
 
stlpnazi's Avatar
 
Join Date: Jan 2005
Posts: 32
Send a message via AIM to stlpnazi
Default Deleting Files

If I delete a file from a shared folder on a server (Windows NT or Server 2000), where does it go? I know it doesn't go into the recycle bin on the local machine from which it was deleted. Does it go into the recycle bin on the server? If so, on which user profile?

Additionaly, does anybody know of a program that will track who deleted what on a server joined to a domain? If you can't tell, at my place of employment we have had issues with users deleting files, and not only do we want to recover them but we want to be able to find out who did it.

Any help is greatly appreciated. Thanks!
__________________

stlpnazi is offline   Reply With Quote
Old 05-23-2005, 02:48 PM   #2
Site Team
 
root's Avatar
 
Join Date: Mar 2004
Posts: 8,007
Default Re: Deleting Files

question 1, where doesit go?
nowhere, it just disapears into the ether, it's irretreivably lost.
the only way to restore is either from a backup, or from some kind of disk forensic restoration process... (I.e either buying specialist recovery software, or sending the disk to someone who'll examin the platters.) if you know that the forensic route is the only way to go then I suggest that you stop using the disk now.
each time a file is erased it is not the file that is erased, just the pointers to the file in the file allocation table on the disk, the more the disk is used after the critical file has been deleted the morechance newly flagged free space (containing the file you want) will be written over with a new file which you may or may not want.

as for the second question, How can I monitor who has acces and who is doing what to which files?
windows doesn't seem to have any built in tools to monitor file sharing, so again there seems to be no way...
I'm less adement about this one though, somewhere out there there must be some tools to do it.
__________________

root is offline   Reply With Quote
Old 05-23-2005, 10:20 PM   #3
Baseband Member
 
stlpnazi's Avatar
 
Join Date: Jan 2005
Posts: 32
Send a message via AIM to stlpnazi
Default

Thank you for the reply. Its amazing how many users on our network actually accidently hit delete on a shared file and accidently confirm it. I was seeing if there was any way to recover it without an external progarm. Thanks again.

Does anybody know of any good monitoring software for server shares?
stlpnazi is offline   Reply With Quote
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off



All times are GMT -5. The time now is 04:05 AM.


Powered by vBulletin® Version 3.8.8 Beta 4
Copyright ©2000 - 2017, vBulletin Solutions, Inc.
Search Engine Friendly URLs by vBSEO 3.6.0