All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 10 posts ] 
Author Message
 Post subject: Date and Time on a delete file
PostPosted: March 10th, 2014, 10:12 
Offline
User avatar

Joined: August 24th, 2012, 8:15
Posts: 139
Location: Dominican Republic
Hello

Quick question i just want to know if its possible to know the date and time on a delete file? Somebody at work deleted something and i want to know when it was delete.

Thanks

_________________
Data Recovery in the Dominican Republic
https://www.recuperamidata.com/


Top
 Profile  
 
 Post subject: Re: Date and Time on a delete file
PostPosted: March 10th, 2014, 10:37 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
A few places you might look,
volume shadow copy tools exist..

I advise to at least listen to the podcast on shadow copies. very enlightening
resources here: http://malthus.zapto.org/viewtopic.php?f=101&t=220&p=535&hilit=shadow#p535

look at event log, depending on the granularity

or try and use a file recovery tool, recover it and see what the last mod, created, last access times are.

I think as time passes it is going to be increasingly hard to track it down

Also, One thing that is often overlooked is that after the effort is made to track down details such as this, nothing ever gets put in place to deal with it again. Take the opportunity to setup the eventlog auditing or however you do your fault tracing. The eventlog can track an enourmous number of things, and with an Active Directory domain and Group Policy, it is pretty easy to do.


Last edited by HaQue on March 10th, 2014, 10:41, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: Date and Time on a delete file
PostPosted: March 10th, 2014, 10:39 
Offline
User avatar

Joined: August 24th, 2012, 8:15
Posts: 139
Location: Dominican Republic
Thanks HaQue, i will verify.

Thank You.

_________________
Data Recovery in the Dominican Republic
https://www.recuperamidata.com/


Top
 Profile  
 
 Post subject: Re: Date and Time on a delete file
PostPosted: March 10th, 2014, 12:21 
Offline
User avatar

Joined: August 24th, 2012, 8:15
Posts: 139
Location: Dominican Republic
Yo Spildit :D

_________________
Data Recovery in the Dominican Republic
https://www.recuperamidata.com/


Top
 Profile  
 
 Post subject: Re: Date and Time on a delete file
PostPosted: March 11th, 2014, 6:44 
Offline
User avatar

Joined: August 26th, 2012, 19:18
Posts: 293
Location: England
Hi Lobox,

If it is a casual check and if the file is still in Recycle Bin just right click and check properties - File Deletion time.

Be careful tho, the time stamp data can easily be modified and different operating systems handle file times differently. Some programs will set the MAC times to correspond with the original rather than the time the copy was made.

If you are to make an important decision, say, calling an employee a lair and firing him, it would be wise to get pro forensic advice first.

K

_________________
Когда хочется кушать – съешь всё.
Голод не тётка!


Top
 Profile  
 
 Post subject: Re: Date and Time on a delete file
PostPosted: March 11th, 2014, 7:08 
Offline
User avatar

Joined: August 26th, 2012, 19:18
Posts: 293
Location: England
Edit - typo: lair -> liar. not had enough coffee this morning :/

_________________
Когда хочется кушать – съешь всё.
Голод не тётка!


Top
 Profile  
 
 Post subject: Re: Date and Time on a delete file
PostPosted: March 11th, 2014, 8:20 
Offline
User avatar

Joined: August 24th, 2012, 8:15
Posts: 139
Location: Dominican Republic
digitalferret wrote:
Hi Lobox,

If it is a casual check and if the file is still in Recycle Bin just right click and check properties - File Deletion time.

Be careful tho, the time stamp data can easily be modified and different operating systems handle file times differently. Some programs will set the MAC times to correspond with the original rather than the time the copy was made.

If you are to make an important decision, say, calling an employee a lair and firing him, it would be wise to get pro forensic advice first.

K



Sup man, thank you for the information, I am not the one who is firing him, is somebody else, I was able to get the info erased, just checking the timestamps to know when it was deleted found a couple of links http://www.forensicfocus.com/forensic-a ... ecycle-bin will let you know in any case.

_________________
Data Recovery in the Dominican Republic
https://www.recuperamidata.com/


Top
 Profile  
 
 Post subject: Re: Date and Time on a delete file
PostPosted: March 11th, 2014, 12:12 
Offline
User avatar

Joined: August 26th, 2012, 19:18
Posts: 293
Location: England
sup dude, thanks for the feedback.
tell boss to be careful.
been in court case where "bad" employee loses job and wins case for wrongful dismissal.
took around £100k GBP in compensation.
Filed against manager personally too in case company couldn't pay (manager could lose house/home etc)
Company closed not much later as loss of reputation practically ensured no new contracts came forward.
completely ****ing scandalous in my eyes. happens every day too i'm sure.

You screw up just this much > . <
Get advice from a pro to mitigate risk. make sure both yours and his insurance is up to date too.

good luck

K

_________________
Когда хочется кушать – съешь всё.
Голод не тётка!


Top
 Profile  
 
 Post subject: Re: Date and Time on a delete file
PostPosted: March 11th, 2014, 12:49 
Offline
User avatar

Joined: August 24th, 2012, 8:15
Posts: 139
Location: Dominican Republic
Thanks @digitalferret for pointing out that critical information i will keep that in mind when talking to the boss.

Thank you once again.

_________________
Data Recovery in the Dominican Republic
https://www.recuperamidata.com/


Top
 Profile  
 
 Post subject: Re: Date and Time on a delete file
PostPosted: March 12th, 2014, 8:26 
Offline
User avatar

Joined: August 24th, 2012, 8:15
Posts: 139
Location: Dominican Republic
Thanks @Spildit i will let you know the outcome.

_________________
Data Recovery in the Dominican Republic
https://www.recuperamidata.com/


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 10 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 5 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group