Why did my files disappear?

[Gabis1207]

Today at the office, a file folder on our network, containing several hundred PDFs (ranging from scanned documents to boilerplates) literally just vanished.
Fortunately, we have been taking regular backups, and I'm working on pulling the AWOL folders and files from said backup, but I can't help but wonder why they disappeared.

If you guys have any ideas, and suggestions on preventing such hiccup from happening in the future, I'd greatly appreciate it if you'd leave them below.

P.S.
The host system is between seven and eight years old, running WinXP.

 

[Joe C]

Might have gotten a bad sector on the drive

 

[Gabis1207]

Wouldn't that affect more than just a specific folder in the C drive?
Granted, it's a big folder, but nothing else was affected.

 

[Lexluethar]

Why? Because it's a file share on a network that everyone probably has access to.

Want to ensure it doesn't happen again? Remove everyone's modify rights to that location.

Want to see who delete the message? Enable auditing on the folder and configure it to log successfully actions. This will log any successful action on that folder (deletion would be included here). Careful though, this type of auditing on a file share that lots of people access will bog down your log files in a hurry. If not a lot of people access the location or make modifications, you won't have much to worry about. If lots of people do you will want to either have those logs forwarded elsewhere or use a 3rd party tool like Trigeo to collect the log files (you still have to enable them in the OS).

 

[Gabis1207]

Why? Because it's a file share on a network that everyone probably has access to.

Want to ensure it doesn't happen again? Remove everyone's modify rights to that location.

Want to see who delete the message? Enable auditing on the folder and configure it to log successfully actions. This will log any successful action on that folder (deletion would be included here). Careful though, this type of auditing on a file share that lots of people access will bog down your log files in a hurry. If not a lot of people access the location or make modifications, you won't have much to worry about. If lots of people do you will want to either have those logs forwarded elsewhere or use a 3rd party tool like Trigeo to collect the log files (you still have to enable them in the OS).

Two people have access to the AWOL folder, both the host and the system connecting over the network, and they both MUST be able to read and write to the folder. Neither of them deleted the folder, their recycle bins haven't been emptied in a week or so, and the folder wasn't present in either of them. It was there, and an hour or so later, it was gone.

Is auditing supported in XP without installing any additional software? Maybe I should look into that.
Would that help me if, as Joe stated, the sector went bad?

 

[Lexluethar]

Doubtful a sector went bad. While that does happen most of the time you will not see files disappear. More importantly when you restart your PC (or the PC housing the share) the computer normally would recognize a bad sector (SMART or even Windows) and scan the sector, recover what data it could and mart the sector as bad.

As this is a share, if users are connecting over the share the items will NOT show up in their recycle bin. The recycle bin only shows locally deleted items. I'm not saying they deleted it or someone else did, but what i am saying is they didn't disappear by themselves.

Do you guys have a domain environment with active directory or are you just logging in locally and sharing out the folder through local permissions?

Here is how you would do it locally on the XP machine:
https://support.microsoft.com/kb/310399?wa=wsignin1.0

 

[Gabis1207]

So what you're saying is this:

PC_02 is hosting the share, and PC_01 can access the share.
If PC_01 deletes the folder, it does not show up in PC_02's recycle bin, it's simply erased similar to removable media?

Am I right, or did I misunderstand you?

 

[Lexluethar]

Correct. Deleting from shares does not put the item in the recycle bin. Only lovally deleted itemd show up (ie if you logged into the pc w the share and deleted the items it wld be in the local recycle bin).

 

[Gabis1207]

so by that logic, the files would still be recoverable using something like Recuva, correct?

 

[Lexluethar]

Not 100% sure, i've never used Recuva before. What does the recovery matter if you have backups?

Here is a thread about someone pointing their recycle bin to protect a shortcut created for the end user. That may be of some help to you:
https://social.technet.microsoft.co...-bin-it-permanently-delete?forum=winservergen