Is there a log created by OS when a directory is deleted in Windows 2000 Professional?

Posted on 2007-07-25
Last Modified: 2010-03-05
One of my directories has been deleted.  I am the only one with access to this computer so I am assuming some type of virus, etc.  Is there a log created by OS when a directory is deleted in Windows 2000 Professional?
Question by:frankmorrison
    1 Comment
    LVL 14

    Accepted Solution

    As far as I know, Win2k generates no specific file/directory deletion log unless the deletion is done by an application that itself generates a log or it is due to a system error that is recorded in the system log.

    You should take a look at the system, software, security and any other logs - accessible via the Event Viewer.  There are scenarios where the system is updating a directory entry at the moment of a system crash or power failure, leaving the directory entry damaged and inaccessible.  This sort of thing doesn't happen very often, but it should create a set of lost clusters that may be identifiable via chkdsk or other drive-verification tools.

    As far as looking for your lost data, the most rudimentary tool is looking in the Recycle Bin - it would only be there it it was explicitly deleted by the OS.
    Next is to run some file system diagnostics - I would not run them in 'repair' mode, just in 'diagnose' mode to see if something is there - e.g., chkdsk w/o the '/f' switch (fix errors)
    Beyond that you are looking at propietary or open source data recovery software such as Ontrack ( and any of the 'free' (and not-so-free) tools that can be found via a Google search.


    Featured Post

    6 Surprising Benefits of Threat Intelligence

    All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

    Join & Write a Comment

    When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
    NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
    Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
    With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    16 Experts available now in Live!

    Get 1:1 Help Now