OK, I get a call today about an employee who has been viewing porno during working hours. They wanted me to come down and get some evidence in case it went legal. The guy deleted most everything that he could (left a few log files around but for the most part deleted everything). At that point I broke out a copy of Hex Workshop, installed it, and proceeded to look for the deleted files. My question is 1: How do you go about looking for the deleted files? I think they are the ones with the .lnk extension but I could be wrong. The second quesion is: how do I restore these files? If there is a better hex editor out there (that is as easy to use, that is) then please let me know. I also dont care about the legal issues that are involved with this (I already know about that part), we just want the files. Thanks.