Files getting deleted while open

I have a customer who is experiencing some bizarre problems with Excel Files. On two occasions now someone has opened files from a shared folder on teh server, been working on them quite merrily and when they go to save the file or even just close it, they are told the file no longer exists. Lo and behold, when they go back to the folder the file has indeed gone. Thing is if someone tries to open a file that is already in use then they get the typical file in use open read only type message that you would expect.

I was always under the impression that when you opened a file you in effect opened a copy and worked on that until such times as you either saved the file, at which point its changes were written back to the original, closed it ignoring changes in which case your copy was just deleted, or saved it as something else in which case the original remained intact and un touched.

So where is the file gone in this case? Its not on the server, its not on the local machine, no trace can be found of a temporary file. The only trace is in the history of documents opened on the machine.

 

After running 4 different recovery tools on the server (Windows Server 2003) and recovering almost 100 deleted spreadsheets around the size of the one I'm looking for I still have had no luck finding the missing file.

Does anyone have any recommendations for applications that will produce a log of files accessed and files deleted by user? For the two files to so completely disappear I am starting to supect malicious action by someone within or possibly even outside the company.