Can i prove a user formatted their drive?

By djice00 ·
Does anyone know if a hard drive format is recorded in the Event Viewer and if so what to search for? I tried searching for "format" but almost every event in there has that word in the description. I have a client that claims the drive just ended up empty and they refuse to believe they did anything to it. I have fully scanned the system and there is no signs of malware.

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Answers

Collapse -

Can i prove a user formatted their drive

by Steve Delgato In reply to Can i prove a user format ...


I found this but I believe that it works or shows details, if its installed before someone deletes the data or files from system.
But still you can try this.

Steve Delgato
Microsoft Cloud Solution Provider

Collapse -


by azabqutb In reply to Can i prove a user format ...

Well, it's really a problematic, but no need to worry about it. Sorry to say that right now I am not having solution of the respective issue, but I can provide you a link they will assist you resolve your problem.

Related Discussions

Related Forums