Re: Deletion of all files owned by specific owner

[GuidoZ <uberguidoz () gmail com>]

I'd highly recommend doing some Google searching on Incident Recovery
and Forensics. Maybe you'll be lucky and Harlan will reply with his
expertise. (See his book here: http://www.windows-ir.com)

Best of luck.

--
Peace. ~G


On 12 Nov 2004 06:43:16 -0000, D Hull <dbhull1 () hotmail com> wrote:
> This evening, all of the files owned by a specific user were removed from a server, including the user's home 
> directory and files owned on an NFS mounted partition.
>
> I did not have any baselines in place to help troubleshoot this problem so I am starting from scratch and don't have 
> much to go on. I realize I am in a bad spot. I am able to recover the data. I need to be able to determine what 
> happened though - as best as possible under the circumstances. Any suggestions would be greatly appreciated.