Figuring out if there's a deleted user account on Windows 7

Question

We are trying to determine which one of 20-30 computers were used by a previous employee. We know that the computer at one point had two user accounts, but one of them was deleted around 6 months ago. The computer in question is the only computer that had a deleted account the last year. Very few of the other computers have had deleted accounts, so it's not a crisis if all deleted user accounts are found, not only the one deleted this year.

Both user accounts had Admin rights. There are no system restore points dating that far back.

The purpose of this is to use some third party tool to recover some lost data from that account. We don't want to try this on all computers, as it might be time consuming, and potentially a risky process. We know the password of the account.

Is there a way to, without installing any software, determining if a user account has been deleted (and if possible the name of said account)?

Edit:

I'd like to recover excel-files, small .txt-files (a few kB), files used by a specific simulation tool etc. Anything stored in My Documents, and/or the folder C:\SimulationTool\Folder\Data.

I've tried searching through the server (where project specific files should be stored) for files owned by that user, but no files were found. This was very strange, but it's possible, since the employee was only employed for a short time.

Answer 1

It would be difficult in the least to determine if an account was deleted so long ago. Depending on the computers usage, any recoverable files quite possibly have been written over. Your best bet to recover the files is to install file recovery software on another computer and use it to examine the drive of the computer in question.

However, if you want to try manually looking, you can try the following:

First off, start by looking at all the Event Viewer logs. Comb through every entry, even new ones. Perhaps a log will list the account name. I would pay close attention to error logs. Perhaps this account was used to set up a service. If the service is no longer functioning, it hopefully list the account name or SID associated with it.

Speaking of SIDs, you could list the owner/creator of all the files on the system. While the account name will not show, a SID will remain for all files associated to that account.

If you want to go even further, look at every .log and .txt file for some record of the accounts existence.