The curious case of the 0-byte Excel file

Last week a user's Excel file suffered a curious malady. They saved it and logged off as normal with no apparent errors, and when they came back to it a couple of hours later, it was 0 bytes in size.

My question is not "how do I recover from this", but "why did it happen". Reports of unexplained data loss/corruption are very rare at my school; since starting here 3 years ago I can count the number of incidents on one hand, and in every previous case I have eventually been able to work out why it happened. This one, however, has stumped me.

Here are the facts:

• The file was an .xlsx file of around 400kb.
• It was saved on a DFS share to which several users have access.
• When I examined the file, the last modified date was 11.33am, matching exactly the time the user reported saving the file, and less than 1 minute before the time the workstation reported a logoff event.
• The user closed Excel before initiating a log off.
• The user reported that no error messages or anything out of the ordinary appeared when she saved the file and closed Excel.
• The workstation she was using runs Windows XP Pro SP3, fully patched, with AVG 8 antivirus, again up to date.
• Office 2007 Enterprise SP1 is installed and up to date.
• The Office Session Diagnostics log in the Event Viewer report that the user's Excel session finished normally.
• The user had not exceeded their server storage quota (with a margin of over 100MB).
• The machine's Application and System logs do not report anything unusual at the time of the logoff.
• The server logs do not indicate anything unusual either.
• Ditto for the antivirus logs.

Short of another user who had access to the file both maliciously replacing the file with a 0-byte version, and modifying the last modified time to match the original time (I don't believe anyone with access to the file would know how to do this except IT support staff, and I have no reason to suspect my technicians), I can't figure out what might have caused this.

Any suggestions??

User error always!!!:p

Perhaps they clicked log off and then were forced to save it or the program end tasked because it could not log off causing some corruption. The time delay on the log may be just how long it took to log them out?

Amazed at how you have taken such a minor problem to task! Kudos to you. We get so many staff lie about never clicking this or that and then finding out later what they told us was a load of rubbish i rarely bother to investigate things like this too deeply. Unless it's the headteachers excel file then of course i will have 5 student hackers lined up ready to be shot within 5 minutes.:D

It often is user error, but in this case I'm not convinced. In fact my very first thought was that a forced logoff closed Excel prematurely, but not only does the user insist they closed Excel separately before logging off, but the log entries corroborate her version of events. Excel reported a clean exit a good 40 seconds before the logoff event was recorded. Even if the logoff mysteriously took much longer than usual, I'm pretty sure Excel should not specifically log a clean shutdown before it has finished saving files.

As I see it, it's not a minor problem. The data in question was pretty damned important, and next time who's to say the backup will be working? I don't like files mysteriously being shafted. What bugs me the most is the unusual nature of it - it's a set of symptoms I've just not seen the like of before.

I had a smiliar issue with some childrens work here, all saved fine and verified by the teacher. When the children try to access later the files were empty/blank, with no apparent reason.

I monitored it for a few days a quickly found that the children concerned loaded up word, click the save button instead of the open button and saved a black document over the top of the originally save one.

Easy mistake for primary school kids i guess.

Apparently if a spreadsheet is damaged Excel automatically trims the data, that's the only reason I can think of that it might end up with a 0 sized file.

The damage isn't necessarily due to user error, but could have been corruption during saving. Unless someone confirmed that the file did have a size after saving I can't think of any way to check whether this was the case or not.

I love my users.

Today I was told that the workstation in question has been turning itself off randomly since about 2 weeks ago...

When Excel saves it saves the file in a temporary file then deletes the original file and renames the temp file. You may find a temp file kicking round somwhere with the excel spreadsheet in it.