-2

A customer relayed to us the issue that one of his users (user B) discovered sensitive documents in his recycle bin, which another user (user A) apparently deleted on a mapped network drive.

Now, I am under the impression that this is not possible. Maybe getting files which one deletes himself to show up in the local recycle bin could be realized with symbolic links but that seems a little far fetched. And there's the issue that user B does not have NTFS permissions to access the folder the respective files are stored in.

As the rogue documents discovered in this local recycle bin are of a sensitive nature and the company's director is sure he has seen this with his own eyes, "this is not possible" is not an acceptable answer for our client.

Are there any technical solutions to reproduce this issue/ is it possible to configure Windows to behave this way? If not, how would I go about proving that this is not a technical issue but rather that these files were handled incorrectly?

Server is a Windows Small Business Server 2008 Client is a Windows 7 Workstation.

They used to share the PC with a different account.

skilfing
  • 1
  • 1

1 Answers1

5

The recycle bin on a local computer only stores files that were deleted locally. A file deleted on a network drive isn't placed in a local recycle bin.

In the Recycle Bin, they can look at the column (view, details) for Original Location to see where the file really was deleted from.

At that point, it's up you you/them to decide what really happened. Meaning if the docs Original Location was User B's desktop, then you'll need to figure out if you want to try and corner User B into a "confession" or let it go.

TheCleaner
  • 32,352
  • 26
  • 126
  • 188
  • 1
    Thank you for your response, that was about what we communicated to the concerned user. I will look into the column view if the issue happens again, did not think of checking that to follow the path of those files. – skilfing Oct 08 '13 at 14:34
  • welcome...if this answers your question please choose the accept button/checkmark. Thanks! – TheCleaner Oct 08 '13 at 14:39
  • @TheCleaner, Since the guy had access to the Computer, isn't it possible for him to spoof the "Original Location"? – Pacerier Apr 25 '15 at 16:30
  • No, that's not editable within the Recycle Bin that I'm aware of. – TheCleaner Apr 26 '15 at 21:40