External HDD data recovery

[wolverine_dcp]

If a folder was deleted on my external hdd and I do the recovery "whichever tool or hardware" does it show who deleted the folder, this is a pc on on a domain in active directory 2008.

 

[PsyWulf]

No,that piece of information wouldn't be recorded. You'd need to enable File Server auditing to record such an event

 

[neilronaldson]

a little app called undelete works well

 

[wolverine_dcp]

a little app called undelete works well

Did you read the full statement....i am not worried about the recovery but who deleted it but thanks anyway

 

[wolverine_dcp]

No,that piece of information wouldn't be recorded. You'd need to enable File Server auditing to record such an event

So unless it's enabled, a hdd drive recovery won't prove it who deleted it, thanks

 

[PsyWulf]

a little app called undelete works well

Lol

 

[PsyWulf]

So unless it's enabled, a hdd drive recovery won't prove it who deleted it, thanks

Correct

This auditing event would be recorded in the event viewer. The data recorded by the file system is fairly limited

 

[wolverine_dcp]

Correct

This auditing event would be recorded in the event viewer. The data recorded by the file system is fairly limited

As far as I know it's gets over written but thanks

 

[PsyWulf]

As far as I know it's gets over written but thanks

Depends on your event settings and how active the monitored folders are. But since it wasnt enabled it's a moot point

 

[wolverine_dcp]

Depends on your event settings and how active the monitored folders are. But since it wasnt enabled it's a moot point

Thank you