Trace Documents being moved from Pc to Flashdrive

Posted on 2014-12-11
Medium Priority
Last Modified: 2014-12-17
I have a new client that just terminated an employee. Right after that event, they checked the employee's Pc and found company documents missing from his stand alone peer to peer Pc. They never took any backups.

I installed Recuva and ran a full system scan for deleted files. The only files found were from a few months ago and there were only a few files per day deleted at that time. Nothing that would point to a mass deletion which is what I was looking for.
I suspect he moved all documents to a USB flash drive and took it with him.

Is there any way to track this down in Windows Logs?
Question by:Tony Giangreco
LVL 59

Accepted Solution

McKnife earned 668 total points
ID: 40495073
No, there isn't. This would require settings for file auditing in place already before the copying.
LVL 25

Author Comment

by:Tony Giangreco
ID: 40495090
That's what I expected. No surprise. Just another instance if the customer not being proactive!
LVL 20

Assisted Solution

marsilies earned 668 total points
ID: 40495152
"Moving" a file to a different drive is basically just a copy + delete function. First the OS copies the file to the destination, then deletes it from the source location. So undelete programs will recover "moved" files, assuming they haven't been overwritten.

You may want to try "Previous Versions" built into Windows 7 to recover the files. See instructions here:

Another possibility is that they were moved elsewhere on the same drive and/or hidden. They wouldn't show up as deleted then. You can use this tool to look for hidden files:

For moved files, search the whole drive:

Other possibilities are that the files were never saved on the PC's drive: the user may have created and kept everything on a USB drive in order to work on the files at home.  Or, if the user was malicious, used a file wiping program to "shred" or overwrite the files on the disk, making undelete impossible.
The 14th Annual Expert Award Winners

The results are in! Meet the top members of our 2017 Expert Awards. Congratulations to all who qualified!

LVL 85

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 664 total points
ID: 40495308
Good reasoning for using a domain.. during the termination interview the user account is disabled in AD
LVL 25

Author Comment

by:Tony Giangreco
ID: 40495313
I agree with the comments. I'll try those tools Saturday morning when I'm there.
LVL 25

Author Closing Comment

by:Tony Giangreco
ID: 40505924
Thanks for confirming my expectations on this one.

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Disk errors can be the source of sundry problems for the Exchange server, the most common one being that the database fails to mount.
With the emergence of Office 365 as a superior email communication platform, many organizations have started switching over to it.  After migrating to Office 365, sometimes users, as well as organizations, will have to import PST files to Office 36…
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.
Want to learn how to record your desktop screen without having to use an outside camera. Click on this video and learn how to use the cool google extension called "Screencastify"! Step 1: Open a new google tab Step 2: Go to the left hand upper corn…

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question