Is there a deleted files history or a windows activity history/log

[Guest]

Hi everyone,

The situation is this:
Where I work there is a person that went around some computers and deleted
or moved an excel file where everybody's work recordings was kept, meaning we
now lost track of who did what. Since that person is quite manipulative, some
of us could end up with a bad report while we all worked hard except for that
one person.

Although we are very suspicious of that person, in front of the boss we will
need proof. The only piece of evidence I have is that the whole company knows
this person was alone when the file was deleted and the period of time that
file was deleted in.
Also bear in mind:
- we don't have any recovery programme on the computer (we have a back up
one for the main server but that won't do much will it), unless McAffee
antivirus has a recovery tool;
- that person has a very superficial knowledge of computers and probably
don't even know what the control panel is.

Which leads us to the main point of this question: is there a way I could
find if my workmate's computer was turned on during that period when only
that suspicious person was around, or even better, a record of deleted files
with the time of deletion?
It also might have been possible that person just moved the file to an
external disk (to pop it back on the comp if the situation looks too grim and
deny it all): is there any way I could find a record of that file's movement?

This is a matter of high importance because I don't want to accuse anyone
wrongly, but in the same time my own position and others in this company is
at stake.

Thanks in advance for any quick answers.

 

[Pegasus \(MVP\)]

See below.

Hi everyone,

The situation is this:
Where I work there is a person that went around some computers and deleted
or moved an excel file where everybody's work recordings was kept, meaning
we
now lost track of who did what. Since that person is quite manipulative,
some
of us could end up with a bad report while we all worked hard except for
that
one person.

Although we are very suspicious of that person, in front of the boss we
will
need proof. The only piece of evidence I have is that the whole company
knows
this person was alone when the file was deleted and the period of time
that
file was deleted in.
Also bear in mind:
- we don't have any recovery programme on the computer (we have a back up
one for the main server but that won't do much will it),

*** It seems you're in bad need of a competent systems administrator.
*** He would install a backup process that backs up all your important
*** files centrally on the server. He would also get staff to store all
files
*** on the server and protect them so that only the owner can access
*** them. What you're doing at the moment - keeping your important
*** files on each PC, totally unprotected - is just not acceptable.

unless McAffee antivirus has a recovery tool;

*** No, that's not its purpose.

- that person has a very superficial knowledge of computers and probably
don't even know what the control panel is.

Which leads us to the main point of this question: is there a way I could
find if my workmate's computer was turned on during that period when only
that suspicious person was around,

*** Yes - check the System section of the Event Viewer (eventvwr.exe).

or even better, a record of deleted files with the time of deletion?

*** Only if they are in the Recycle Bin.

It also might have been possible that person just moved the file to an
external disk (to pop it back on the comp if the situation looks too grim
and
deny it all): is there any way I could find a record of that file's
movement?

*** No.

This is a matter of high importance because I don't want to accuse anyone
wrongly, but in the same time my own position and others in this company
is
at stake.

*** Then put your IT operation on a professional basis. What you're
*** experiencing is self-inflicted, perhaps out of a false sense of economy.

 

[Kit]

Nice isn't it ... to work with people of that caliber (or lack thereof)? Slap
her! LOL! If she cut and pasted onto floppy or flash drive and disposed of
elsewhere -- like her own PC at home, there may be a way to see when it was
there and disappeared, but I have never heard of such a thing. I was always
told when a document is emptied from recycle your PC bin it is gone ... BUT,
your IT department can tell when email was deleted, or even recover files
deleted off a corporate server where everyone stores things. I deleted a few
of my own critical spreadsheets accidentally from our Corporate Drive and IT
recovered them for me (thank God). Would that just turn this woman's fce
sheer white?! LMAO! Good luck ... and trip the b**ch when no one is looking!

 

[Kit]

http://support.microsoft.com/kb/308427

The security log records events such as valid and invalid logon attempts, as
well as events related to resource use, such as the creating, opening, or
deleting of files. For example, when logon auditing is enabled, an event is
recorded in the security log each time a user attempts to log on to the
computer.

You must be logged on as Administrator or as a member of the Administrators
group in order to turn on, use, and specify which events are recorded in the
security log.