Windows

General discussion

Gravatar
Locked

File access by user

By BlitzSonik ·
Here is the grand-daddy of them all. I'll try to give a detailed background before I ask my question.

Small accounting and tax office acquired some time ago by my company. I have just assumed IT responsibility. Almost all previous company employees have since left the new company. The last one to leave did so in an inappropriate manner.

Her position was the only one of its kind in the entire region. No one left knows what she did, how she did, or what files, programs, access rights she had. Before she left, she deleted all her email for her mailbox including all archived items. Since our wonderful corporate guys didn't keep an good eye on backups, we now have none of her email whatsoever. Thankfully, that is not MY concern.

My issue is that she also deleted all of here documents as well. It also, appears she used scrubber of some sorts because I have tried three different fully licensed data recovery products and not one of them see any of her files ( it sees other deleted file just fine). I know that they existed because she left the recent access list and they point to files that should be in her My Docs folder.

All that being said, we have a file server (Win2K) containing approx 100 gigs of data that is stored in an ungodly, unorganized fashion (inherited). I now need to find anything and everything she may have ever opened. We have clients dropping left and right because we can't provide them with whatever she did.

Does anyone know of any software or script that would allow me to find all the files that her user account ever access on the server. Digging through event logs isn't viable and sifting through 1000's of excel files to determine if it?s related or not is just as impractical.

I am giving away nearly half my points to the one answer that helps the most. All input is welcomed and appreciated.

Thank you in advance!

Blitz

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

gravatar
Collapse -

by q.support In reply to File access by user

Greetings Hoosier! I used to live in Bloomington, now in Sydney, Australia.

My response may not meet all of your expectations. However, see if it helps, okay? And no, I'm not after your points.

Given your description, I've assumed the following:
1. The scrubber was used on her computer. If so, I wouldn't waste my time on her computer
2. That the user's account name is still alive on your W2K file server.

As you know, every file is stamped with details such as: Author, Date Created, Date Accessed, etc.

On your 100GB HDD, use the search function in Windows Explorer to find ALL the Excel files. *.XLS will do it.

After that, change to "Detail" view.

Click on View, Choose Details. This allows you to select more columns like: Author, Date Accessed, etc.

As an example, "Author" will allow you to find Excel files that your user created.

Keep refining the search until you get the files you need. All the best.

Kind regards

gravatar
Collapse -

by BlitzSonik In reply to

Sorry but this is no good. Windows 2000 search feature does not allow me to choose Author as a column. Thanks for your answer tho.

gravatar
Collapse -

Dir Command

by HerMit In reply to File access by user

I know this post is pretty old, but found it when looking for info on how Windows handles the 'Date Accessed' attribute and thought I'd take a stab since there isn't a solution posted yet. I'm sure you've already solved it on your end, and I'd enjoy knowing what you did. Here is what I would try in your situation:

At command prompt, navigate to the root of the directory structure that you need to check. Run 'dir /q /s' and pipe it to a text file. Import the data into Excel (not clean, but you can at least arrange a column for the owner, for sorting) and sort by owner.

It's a thought...

Back to Windows Forum

Start or search

Related Discussions

Related Forums