External drive files deleted by unknown source

Tags:
hard drive
Security
Left my external hard drive at my office and a month after I noticed files were missing. IT forensics tried to recover, but they couldn’t find any trace. I believe someone accessed and deleted the files, but how can they leave no trace of deleted files? Is it also possible to see who actually did that? At our office, we all use log in details to use the computers, thanks!
1

Answer Wiki

Thanks. We'll let you know when a new response is added.

Unless you have some auditing software you may never find out who deleted them. If they had the amount of time to access and delete the files while undetected, they may have also done a defrag on the drive making recovery impossible.. Do you have any disgruntled workers that may be out to sabotage anyone one or the company ?

Discuss This Question: 2  Replies

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.
  • Subhendu Sen
    Some confusions are there? After one month you have noticed that your files were missing. So, is it that, after left the external HDD you never checked the HDD throughout the month? If yes, why? After left that one at your office, have you informed to a person of your office? Now second thing, Your IT persons did a forensics, that means they performed a forensic investigations on the system(s) using native auditing (assuming this windows OS). That means, auditing is enabled but make sure that each folder’s auditing settings must be modified to include the users you wish to audit. Also is it enabled on local/domain security policy settings, that also be an important part. When they forensics, did they do all computers/systems or a specific system(s)?
    130,760 pointsBadges:
    report
  • Kevin Beaver
    Audit logs, etc. will help. However, unless and until you are prepared to detect malicious behavior - in advance - it's going to be too little, too late once the misdeeds are done.
    27,435 pointsBadges:
    report

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

Thanks! We'll email you when relevant content is added and updated.

Following

Share this item with your network: