Missing files/folders??

[adamf]

A strange problem that occured today...... A pupil logs on to find they are missing all their work, nothing but 2 folders in their home directory - my pics and my music (i think).

 

When we right click on the home directory and goto properities, Windows claims there is 190 files and 46 folders but yet none can be seen - and before anybody says it they are not hidden

 

Any ideas??

[kmount]

Permissions removed from the user to see the files perhaps. (Not hidden).

[adamf]

Nope, we as admins have full control of the folder as does the user

[kmount]

Dodgy folder redirection?

Can you see the files on the server?

[adamf]

Nope, I can't see the files/folders on the server either....

[Tamarside]

Have you tried to do a DIR command via the command prompt?

[adamf]

Just done a DIR at the cmd prompt, it shows the number of directories we can see in the folder

[jamesb]

Might be worth trying a dir command with switches, e.g. dir /a:drhas /s

 

That should also give you files in the subdirectories, as well as listing any files tagged as system files.

[Tamarside]

Right, can yoiu give us some more information? I'm assuming we're talking about files and folders residing within the user's home folder on a file server?

Please forgive me if some of the questions below seem to insult your intelligence - I like to consider all options and it is not in any way intended as a reflection on you.

- Have you tried accessing it from different machines, and does that change anything? This will help determine where the problem lies.

- Have you tried looking at the folder using BartPE's file explorer? As it sits outside the normal Explorer.exe process it may just give you a different view.

- Have you tried to make a backup of the home folder using NTBackup, then restore that to a location on a machine that you can start off a BartPE disk?

- Have you scanned for rootkits?

[adamf]

I've done a dir /a /s and it looks like the contents of the home directory or at least some of it is in the RECYCLER\Account SID folder

 

Any ideas how I can get at it?

[jamesb]

Look in the recycle bin? C:\Recycler

 

And tell him not to delete it in future.

[adamf]

When you delete files/folders from a network location they don't go to the recycle bin do they?

[adamf]

Got it. Logged on as the pupil and restored from the recycle bin!

[srochford]

When you delete files/folders from a network location they don't go to the recycle bin do they?

 

It depends :-)

 

If you redirect my documents etc to a network location then they are "protected" by the recycle bin (as you have found) but "normal" network files are not.

 

You may want this to happen; in which case do nothing. If you don't want this to happen then you can turn it off - set a value NukeOnDelete to 1 under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket and all deleted files will be deleted immediately rather than being recycled.

[mrforgetful]

Yeah srochford's correct. Files deleted from redirected drives or UNC paths are seen as network files so completely deleted.

 

Files deleted from a redirected My Documents folder are treated as local files so sent to recycle bin unless you specify not to in Group Policies.

 

We have them set to completely delete due to the amount of space they waste in Recycles.