Who deleted it?

[JBruyet]

Hey all,

We have shared files on a Novell 5.0 server (that I inherited) and occasionally some of those files get deleted. Sometimes entire folders (along with subfolders) disappear. I usually recover the files using FILER, and what I can't recover that way I have Veritas BackupExec. My question is this--is there a way to see who deleted the files/folders? I don't want to see ALL files and folders that get deleted because there are tons of those, but if there's a way to see who deleted a particular file or folder that would be great! I'm not all that proficient with Novell so keep any explanations kinda simple.

Thanks,

Joe Brouillette

 

[marvhuffaker]

Filer is an old dos based utility that sucks.

Assuming you have the Novell client, and you are using a Windows workstation - you should be able to go to the folder where files are deleted, right click on the folder, hit "Salvage" . It should display a list of deleted files that have not yet been purged (Same concept as Filer, but graphical). You can see all kinds of stuff about the file, when, who, etc.

Also, it an entire folder disappeared, it's more difficult to find.. With Traditional volumes, which you most likely have, anytime a folder is deleted, it's pretty much flattend and all files that were in the folder go to SYSELETED.SAV, which is a hidden folder. With admin priviledges you should be able to view it as long as you have Windows configured to show hidden folders.

Marvin Huffaker, MCNE

http://www.redjuju.com

 

[TheLad]

Using Salvage as Marv suggests, by the filename it will show the User ID who deleted it and also the date/time as well.

--------------------------------------
"Insert funny comment in here!"
--------------------------------------

 

[JBruyet]

Ok, I'm running Salvage. On the left pane I see the folder name I'm looking for (concatenated to eight characters). On the right pane I see the date the folder was created, the time it was created, <DIR>, and a name. I thought this was the name of the person who created the folder. Is this name the name of the person who deleted the folder?

Thanks,

Joe Brouillette

 

[JBruyet]

I should also say that when I try to run Salvage from within Windows I get the following error messages:

DESCRIPTION
The system cannot locate any network drives.
SEVERITY
Further program execution is not possible.

When I ran Salvage from a command prompt it worked fine.

Thanks,

Joe Brouillette

 

[marvhuffaker]

Salvage isn't something you run. You should open Windows explorer, find the network drive, Right Click - then Choose Salvage from the menu that comes up.

Salvage WAS a command line utility that is in the same category as Filer, but I would consider it obsolete.

Marvin Huffaker, MCNE

http://www.redjuju.com

 

[JBruyet]

marvhuffaker & thelad,

Thanks for the help. I WAS able to right-click on the folder and choose Salvage as an option. AND, on re-reading marvhuffaker's email I see I missed the part about right-clicking the first time around.

Now, since it was a folder that was deleted I wasn't able to see any information on it by using Salvage. I've tried a couple of ways to get into SYSELETED.SAV (Network Neighborhood and NWAdmin) but I haven't been able to. If I go into NWADMIN and check out my profile I see that I have Security Equal To admin.domain_org. I also double-checked to make sure I can see hidden files and folders. Is there another way to get in to SYSELETED.SAV to see if I can tell who deleted the folder?

Thanks,

Joe Brouillette

 

[marvhuffaker]

Hey one thing I realized is that I misled you slightly. The DELETED.SAV folder would be on whatever volume your folder was on that got deleted.

It doesn't have to be just SYSELETED.SAV. It could be VOL1ELETED.SAV or DATAELETED.SAV.

Just wanted to clarify.



Marvin Huffaker, MCNE

http://www.redjuju.com

 

[JBruyet]

Hey marvhuffaker, that was it! I have found the DELETED.SAV folder and I'm going to go hunting.

Thanks for all the help.

Joe Brouillette