The possibility of finding a file access log detailing deleted files.

[memeticist]

Hello,

I apparently deleted some files, though precisely when is an open question (likely within the last 3 months). I have already run a few file recovery programs to no avail. The files are mostly scientific articles, so they are replaceable. The catch is I need to know which files that were deleted.

I know that Windows is renowned for the amount of data it logs about system activity. I was hoping that there is an access log buried somewhere that I could search for the folder names and find a list of the specific files that were deleted. Also, any recommendations on the program(s) that would be helpful in doing this. I am running Windows 7 Professional x64 on a Dell Latitude D830.

Thank you so much for any help you can offer

 

[LMiller7]

Windows does not log that kind of thing unless file system auditing is enabled and the appropriate options set. This is NOT enabled by default. This auditing would consume a large amount of disk space in quite a short period of time unless it is very selective.

The real solution to this kind of problem is to maintain backups of all important files. There are a variety of ways that data can be lost and not all are preventable and not all recoverable. You need to be prepared when (not if) something happens.

 

[Callender]

Detect names of deleted files

Hi,

It might be worth running a analysis of your HD with Autopsy. It's a data intensive application so it's not fast but it is very thorough. If this can't list your deleted files then the file names are almost certainly unrecoverable.

Autopsy: Download

Note: When applying file filters it can take a while before the results are ready to display.

For viewing old folder names only try:

ShellBag AnalyZer, ShellBag cleaner

 

[whs]

I keep restore points on my data partitions. Those don't take a lot of space and allow me to retrieve any prior files. The amount of restore points depends on the allocated space for the shadowstorage. I usually assign 10% of the partition.

To recover the files I use Shadow Explorer. http://www.sevenforums.com/tutorials/132087-shadowexplorer-recover-lost-files-folders.html