Missing user documents


I can't quite make sense of this. Hopefully someone can help.

I have a small domain with about 20 XP SP3 client machines. There are 25 or so domain members.

One of my users had some files "disappear" from his My Documents Folder. After checking the recycle bin and searching for hidden files and folders with no luck, I logged in as admin and looked at his C:\documents and settings\'username' folder and found that it was created on his original hire date in 2009. (nearly a year ago)

Inside of that folder I looked at his My Documents folder properties and found that it was created yesterday right around the time his data went missing. The same scenario is true for his Favorites, Start Menu and Desktop.

His cookies folder had 1 cookie inside and the index file. This folder had the original creation date from 2009.

I revealed hidden files and folders to check their creation date and they were all the originals from 2009.

He originally reported to me that his user profile was gone. This doesn't appear to be the case since his profile folder had the original creation date, and most of the contents were still in tact.

I also pulled the drive and connected it as a slave on another computer. I then ran "Restoration" - a free file recovery program I downloaded. It shows hundreds of files deleted (and removed from the recycle bin) yesterday from this user's My Documents folder.

This is only affecting one user on a computer that has several user profiles on it.

Everything points to the user having deleted the data himself but he swears he didn't.

Can anyone tell me if they've ever seen the contents of the My Documents go directly past the recycle bin to being permanently deleted or is it possible that a hardware or software problem could be so selective as to only corrupt 1 user's data?

Any help is greatly appreciated.
1 answer Last reply
More about missing user documents
  1. Quote:

    Any help is greatly appreciated.

    [#0005ff]It would be interesting to see what the Event Viewer has to say about what was going on at the time those new folders were created. [/#000ff]
Ask a new question

Read More

My Documents Windows XP