Cant figure this one out...

Just can't figure this one out... Has anyone ran into something like this before?

User reported to me this morning that all her files in My documents were gone. Crazy thing is all the folders that held the Office files were still there. So its like someone went in and deleted files and left all the folders where they were. There were things in recycle bin, but after restoring those the user told me not everything was in there. It seemed to be a copy of the entire my docs folder in the recycle bin, folders and all. But the folders that were in the recycle bin were still in my documents.....

Her profile is loading correctly. All files on her desktop are there. Two different virus scans turned up clean. I dont believe i was hacked or anything crazy like that. She locks her door after work and locks her computer, doesnt give her password out.

I ran diskdigger, some data recovery software i found in the data recovery section and i seem to have recovered the lost files the best i could.

My backups are made via ntbackup. its set up to backup profiles, home drives, campus network drive, but the profiles are not showing up in the recovery console for some reason so thats of no help to me. unfortunately she doesnt backup files to her home drive at all.

I have no idea how this could have happened. Just doesnt seem feasible that someone would deliberately break into her office, "hack" her password and just sit there deleting files that would be pretty worthless to anyone trying to gather valuable data. even if that did happen, why would they delete all the files instead of just copy?? doesnt make sense.

Thanks for taking the time to read this. Any advice is much appreciated.

Steve

 

Now that is a coincidence, because I have been trying to help someone in the UK with Office 2007 who has had what seems to be the same problem - empty Office folders. I'm not getting any forum responses from her other than that the search program Everything did find her files, but I don't know where.

I'll ask her by PM.

 

Yeah i might have to take the time and run through that. I scanned it with SAs and mwb and it came up clean as expected.


@earthling. Crazy thing is its only file in my docs. She had office file on her desktop there were not touched. search came up with nothing.

 

I've sent her a PM and will come back if she responds. I've re-read her posts and it seems to be an identical problem and MBAM reported system clean.

This is the utility she said found her files, using .doc and .xls as search terms. Worth a try.

http://www.voidtools.com/

 

I tried Everything, and it seems to be a great program. However it did not find what i needed unfortunately.