General discussion
-
Topic
-
File access by user
LockedHere is the grand-daddy of them all. I’ll try to give a detailed background before I ask my question.
Small accounting and tax office acquired some time ago by my company. I have just assumed IT responsibility. Almost all previous company employees have since left the new company. The last one to leave did so in an inappropriate manner.
Her position was the only one of its kind in the entire region. No one left knows what she did, how she did, or what files, programs, access rights she had. Before she left, she deleted all her email for her mailbox including all archived items. Since our wonderful corporate guys didn’t keep an good eye on backups, we now have none of her email whatsoever. Thankfully, that is not MY concern.
My issue is that she also deleted all of here documents as well. It also, appears she used scrubber of some sorts because I have tried three different fully licensed data recovery products and not one of them see any of her files ( it sees other deleted file just fine). I know that they existed because she left the recent access list and they point to files that should be in her My Docs folder.
All that being said, we have a file server (Win2K) containing approx 100 gigs of data that is stored in an ungodly, unorganized fashion (inherited). I now need to find anything and everything she may have ever opened. We have clients dropping left and right because we can’t provide them with whatever she did.
Does anyone know of any software or script that would allow me to find all the files that her user account ever access on the server. Digging through event logs isn’t viable and sifting through 1000’s of excel files to determine if it?s related or not is just as impractical.
I am giving away nearly half my points to the one answer that helps the most. All input is welcomed and appreciated.
Thank you in advance!
Blitz