Sharepoint Forum

Ask Question   UnAnswered
Home » Forum » Sharepoint       RSS Feeds

Detective work

  Asked By: Emanuel    Date: Jan 02    Category: Sharepoint    Views: 843

I have a customer with a full Sharepoint 2003 server that needs me to
find & recover some deleted files from a sharepoint document site.

I have good SQL backups of the DB, and backups of the SHPT server
itself. They are using a full SQL server install.

I have email alerts of when the files were "deleted by (unknown)"


1. I think the only way to successfully recover these docs is to restore
the backup to a test site or test server. Any other ideas?

2. Is there a logging area I can see exactly who deleted these? There
is some foul play at work, and the greater the evidence, the better for
my customer.



2 Answers Found

Answer #1    Answered By: Himanshu Gohil     Answered On: Jan 02

1) Unless you had already implemented a 3rd party "recycle bin", then you are
2) There are the IIS logs, but depending on how the files were actually
deleted, they may or may not include useful information. The reason the alerts
say "unknown" it that the alerts are asynchronous, and the files are already
gone before the alert fires, so there is no username info to read.

Answer #2    Answered By: Ashton Schroeder     Answered On: Jan 02

Its amazing there is no security log of user
logins and deletes etc. I'll check out the IIS logs.

Didn't find what you were looking for? Find more on Detective work Or get search suggestion and latest updates.