I'm dealing with a puzzling situation where several folders on a Windows 10 computer connected to a network have had all their files deleted without any clear explanation. The files aren't in the Recycle Bin, and I didn't have Sysmon or file auditing set up at the time. The Event Viewer logs are also unhelpful, and I've tried using Recuva to recover the files, but that didn't work. I need help with two main points: First, what are some reliable methods or tools to recover these deleted files? Second, how can I determine when and how they were deleted—is it possible to find out if a user deleted them manually, if it was done by a script, or if some system process was involved? I'd really appreciate suggestions from anyone who has dealt with similar issues or has experience in forensic investigations on Windows systems. Thanks in advance!
5 Answers
I really hope you have backups. If not, you'll want to start looking into Shadow Copies first. Sometimes users will move files accidentally, thinking they were deleted. Check other folders and see if you can find any clues. Start with a quick search in the main directory—files can get dragged around easily.
Was any of the data stored on a DFS share or a redirected folder? I had a similar situation where a user thought they deleted things on one computer, but they were actually gone from their entire network setup because of that—might be worth checking if that's the case here.
If you don't have shadow copies set up, that’s a big miss. Also, keep in mind that for network shares, deleted files usually don’t go to a recycle bin, which makes recovery even more difficult. Planning ahead with those features is crucial for avoiding situations like this in the future!
Honestly, this kind of issue happens more than you’d think, often due to user error. People sometimes accidentally move files instead of deleting them. If you can remember the names of the missing files, start searching—shadow copies can help here. Remember, if audit logging wasn’t enabled, it’ll be tough to track down who did what.
The best step to take first is to check if you have any backups available. If you're using Windows, Shadow Copies can be a lifesaver here—check to see if they're enabled and if there's a recent version of your folders saved there. It's also worth auditing the access permissions to see who might have deleted or moved those files.
I'm pretty sure there are no backups, which makes this trickier!