I need your assistance. Any help or advice would be greatly appreciated. Now, in the past, files have been deleted by another employee “accidentally” according to my office manager. I was able to find the file(s) on the two occasions with the assistance of IT. Today, the office manager discovers that files that are in seven key individual folders are deleted. The folder themselves remains, but the contents of the each folder is deleted.

I have dedicated a machine to act as my fileserver and installed 500GB of memory in it. The new drive was opened as a share drive and all restrictions were removed, thus allowing documents to be edited. I was working on documents within the folders at 3:30am this morning, so I know the files were there.

Considering all things possible, especially when it comes to computers, could the individual files get deleted, but not the folders? Or, is someone actually deleting the files?

One other thing, I checked the recycle bins of all computers. The files were not inside either machine. And, the machine that has the additional hard drive, its’ recycle bins was empty. If it appears that I am leading the witness, please disregard, I have tried only to state the facts.

Again, thanks for your assistance.

First off, that's a question for your IT department (sure wish I had an IT department...).

Secondly...don't you have a computer that you own? (I'd rather own my computer and have my files safe than have an IT department...)

Thirdly, files on a computer are never really "deleted" until they're written over with something else. Take the computer to the IT Department and hopefully they can help you find the deleted files...if not there are companies that handle this.

I strongly suggest keeping backups of any files that are in public places from this point forward.

Files don't simply disappear, so someone is physically deleting them. Is there FTP access to the machine and drive where the files are kept? If so, an FTP client could delete the files without placing them in a recycle bin.

Two things should occur, in my opinion, while I am making assumption that you are the office broker.

1) Figure out who is deleting those files. If malicious and an employee, then fire them.

2) You should keep office files on a drive that is inaccessible by anyone except you. All agents in your office should provide you with a copy of documents they work on and then you place them in the private drive. If you need agents to be able to work on files on a central computer, then you should setup a process that auto backs up those files to a drive that allows for only your access.

If the computer is acting as a server over the internet I would suggest you check your log files first. Chances are it was not an employee who deleted your files. If it was an employee it would likely show up in the log files.

All day long and especially in the overnight period there are endless intrusion attempts on most servers. Most of the attempts are automated and when a vulnerable server is found all sorts of nasty things can happen. Usually the server is just used as a zombie but files do get deleted.

Even checking the log files will not always reveal intrusions from the "pros"- there is popular software out there that rewrites the log files to cover up the intrusions. An employee probably would not be using such software though and their activities would show up in the log files.

Thanks Man and Ben.

Doug, automated intrustions...that's interesting. My computers are always on for back up purposes. I will have to get with you on checking the log files. Thanks.

OK, I used to be an IT manager only a year ago.

You have some big problems here. Firstly, I am assuming this is a windows based system. That being said, when you delete a file across a network it doesn't go to a recycle bin, it is just deleted. Also, to log deleted files, you must turn it on first. It is not an automatic thing and your IT group may not have done it. When you turn it on, it takes up lots and lots of room in the log files and most servers can only hold a few days of the logs. This is why it is not turned on automatically.

To fix this problem you must must must lock down your server so only authorized users may access it. This is sooo easy, your IT group should have no problems doing it. Especially if they are using "active directory".

To comment on the file deletion thing, yes it is possible to delete a large group of files, without touching the folders. However, the computer still would have to be commanded to do it.

To comment on the part where someone said a deleted file is not deleted for real. Well, not all IT departments have the kind of hardware/software to recover documents deleted over a network. Referring to a backup is the best way to recover, but to do a low level disk recover is not common and can be expensive.

Steve, thanks for the information, I will relay this to my IT. I find it interesting that files can be deleted without touching the folders. And, I will ask IT to make sure the deleted log file function is turned on because we generally do not need to go beyond a 24-48 hour period; usually mistakes or accidents are caught within that same period.