0
Recently had a user in Windows 8 who deleted their local account without permission and thus making it difficult for me to find logs of when passwords were changed etc.
The laptop works as a standalone. I would like to recover all possible files, even revert the changes if possible.
I have looked in Event Viewer, but cannot find anything about password changes. Would like to get some evidence as well as the files back if possible.
How can accomplish this?
Bradly Spicer
Posted 2014-05-02T14:13:56.610
Reputation: 143
You say deleted their account - domain, workgroup, local?
Which passwords and files are you needing to recover? Are they local to the machine or stored on a file server? A domain controller? an Exchange server?? We need more to work with before we can really help.. – Fazer87 – 2014-05-02T14:36:06.517
Sorry +Fazer87, I have updated above. – Bradly Spicer – 2014-05-02T14:48:34.727