The curious case of the 0-byte Excel file
Last week a user's Excel file suffered a curious malady. They saved it and logged off as normal with no apparent errors, and when they came back to it a couple of hours later, it was 0 bytes in size.
My question is not "how do I recover from this", but "why did it happen". Reports of unexplained data loss/corruption are very rare at my school; since starting here 3 years ago I can count the number of incidents on one hand, and in every previous case I have eventually been able to work out why it happened. This one, however, has stumped me.
Here are the facts:
- The file was an .xlsx file of around 400kb.
- It was saved on a DFS share to which several users have access.
- When I examined the file, the last modified date was 11.33am, matching exactly the time the user reported saving the file, and less than 1 minute before the time the workstation reported a logoff event.
- The user closed Excel before initiating a log off.
- The user reported that no error messages or anything out of the ordinary appeared when she saved the file and closed Excel.
- The workstation she was using runs Windows XP Pro SP3, fully patched, with AVG 8 antivirus, again up to date.
- Office 2007 Enterprise SP1 is installed and up to date.
- The Office Session Diagnostics log in the Event Viewer report that the user's Excel session finished normally.
- The user had not exceeded their server storage quota (with a margin of over 100MB).
- The machine's Application and System logs do not report anything unusual at the time of the logoff.
- The server logs do not indicate anything unusual either.
- Ditto for the antivirus logs.
Short of another user who had access to the file both maliciously replacing the file with a 0-byte version, and modifying the last modified time to match the original time (I don't believe anyone with access to the file would know how to do this except IT support staff, and I have no reason to suspect my technicians), I can't figure out what might have caused this.