Articles

another users' recycle bin

dell something
November 2, 2006 at 13:15:56
Specs: xp sp2, 2.8/gig

For whatever reason, a user has been deleted from our system (she was fired). Well, her boss now wants to go through her Recycle Bin on her computer -- problem is, we can't log on as her any more as her account has been deleted.

I've tried looking in C:/Recycler, but that just show's the current user's recycle bin. I've tried searching for info2 and the first file in her recycle bin (dc1.txt, dc1.doc, dc1.xls, etc. trying about 70 different extensions). No luck.

Without re-adding her to the active directory, is there any way we can view the contents of her recycle bin? I must emphasize the "without re-adding her to the active directory" as that's about 5 days of red tape around here.


See More: another users recycle bin

Report •


#1
November 2, 2006 at 14:33:46

try winhex and run a scan in forensic mode:

http://www.x-ways.net/winhex/

Today's subliminal thought is: 'Calm down ... it's only ones and zeros.'

icq 10183575


Report •

#2
November 2, 2006 at 14:41:10

if she was smart enough to delete them, it's likely that she was also smart enough to EMPTY the recycle bin too, right?

Maybe there is a specific reason you are wanting the recycle bin, but my suggestion would be to use a recovery program like R-Studio that could recover trashed, deleted and seamingly "permanently" deleted files quite easily.

Also if her account was deleted but her user directory was NOT, then you could login as Admin on her old PC and broser to \Documents and Setting\(her account).

Also depending on how desparate you were to rocover whatever files (and you didn't mind possibly thrashing the PC) you could perform a system restore to the day or so before she left and then recover any of her documents under her user profile.

After performing the system restore I would highly recommend rolling it back and/or re-installing XP. I have seen XP do weird things after a system restore.

Maybe you can provide some more detials as to specifically what you are looking for or if you are just evaluating anything and everything about the user's usage and myself or another user could add more ideas.

Hope that helps!

Michael

Live, Love & Google!


Report •

#3
November 2, 2006 at 14:55:35

I'm just the IT guy, her boss wants to look at her old PC's items she may have deleted. All current files are stored on a shared drive, and we can see her files by going to documents and settings/hername ... but the recycle bin products are missing.

it's not a matter of us looking for dirt on her, there's a specific file they're searching for that may be in there that her replacement will need to do her job. she was fired and didn't have any time to go back to her computer, so we don't have reason to believe she terrorized us or is hiding things, we just want to cover tracks and look through her recycle bin for this file...

without purchasing 3rd party software, not sure I can do this.

I was under the impression that a system restore didn't affect files whatsoever, just system files?


Report •

Related Solutions

#4
November 2, 2006 at 14:59:19

I was under the impression that a system restore didn't affect files whatsoever, just system files?

You're correct - just system files essential to the OS.


i_XpUser


Report •

#5
November 2, 2006 at 16:06:49

My bad. As XPUser already pointed out you are correct.

I have done some Google searches myself and can't seem to find any indication of how the OS distinguishes and stores the Recycle bin for different users.

As a test I wanted to see if it was retained in the User Directory Profile, so I created a new local user "testuser" on the system. Then copied my user directory and renamed to the \Documents and Settings\testuser directory and logged in as testuser again. No luck :(

If it was a file she used commonly you could check:

\Documents and Settings\hername\Recent Documents\

to see if there is a reference to the file in question which would then give you the location, but as to how to get into the recycle bin I have no idea.

I would still only be able to suggest installing a recovery program as mentioned earlier. I believe R-Studio / R-Undelete can be used free for 30 days before having to buy, so that may be an option.

Sorry I couldn't be of more assistance.

Michael

Live, Love & Google!


Report •


Ask Question