# Any way to tell if a document was deliberately deleted?

**URL:** <https://boards.straightdope.com/t/any-way-to-tell-if-a-document-was-deliberately-deleted/265549>\
**Category:** Factual Questions\
**Created:** [September 22, 2004, 8:14pm UTC](https://boards.straightdope.com/t/any-way-to-tell-if-a-document-was-deliberately-deleted/265549 "2004-09-22T20:14:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sat\_on\_Cookie](https://avatars.discourse-cdn.com/v4/letter/s/71c47a/32.png) [@Sat\_on\_Cookie](https://boards.straightdope.com/u/Sat_on_Cookie)\
**Post date:** [September 22, 2004, 8:14pm UTC](https://boards.straightdope.com/t/any-way-to-tell-if-a-document-was-deliberately-deleted/265549/1 "2004-09-22T20:14:55Z")

</div>

Here’s the deal.

My co-worker strongly suspects a document she was working on was deliberately deleted by the mean office trolls.

We have IMacs (gag), the document was in word and she saved it to a network folder. Upon returning to the office after being out for a few days, the document is no longer in the folder. She did a “find file” and the doc was found but when she goes to pull it up, it says the doc doesn’t exist.

Does this just sound like a computer glitch? It’s not in her trash folder, and she suspects the person who she thinks deleted it would have emptied her trash can (on that person’s computer, if she did it from there) to remove evidence of such a dastardly deed.

Oh, and the head computer person is sleeping with one of the suspected trolls, although I really, really doubt he would stoop to document deleting; more, I just don’t think he’d be the best person to go to b/c it would most likely get back to a troll.

---

<div class="post-metadata">

**Author:** ![overlyverbose](https://avatars.discourse-cdn.com/v4/letter/o/9dc877/32.png) [@overlyverbose](https://boards.straightdope.com/u/overlyverbose)\
**Post date:** [September 22, 2004, 8:28pm UTC](https://boards.straightdope.com/t/any-way-to-tell-if-a-document-was-deliberately-deleted/265549/2 "2004-09-22T20:28:26Z")

</div>

Who else has access to the network server? Could your co-worker ask someone else (not the head computer guy) to retrieve the document and let her know who deleted it? She doesn’t necessarily have to say why.

---

<div class="post-metadata">

**Author:** ![Sat\_on\_Cookie](https://avatars.discourse-cdn.com/v4/letter/s/71c47a/32.png) [@Sat\_on\_Cookie](https://boards.straightdope.com/u/Sat_on_Cookie)\
**Post date:** [September 22, 2004, 8:31pm UTC](https://boards.straightdope.com/t/any-way-to-tell-if-a-document-was-deliberately-deleted/265549/3 "2004-09-22T20:31:09Z")

</div>

I guess that’s part of my question – so it _is_ possible for someone having access to the network to retrieve the document and see what happened?

---

<div class="post-metadata">

**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\
**Post date:** [September 22, 2004, 8:39pm UTC](https://boards.straightdope.com/t/any-way-to-tell-if-a-document-was-deliberately-deleted/265549/4 "2004-09-22T20:39:40Z")

</div>

If you are able to find the file, but opening it reports an error that it doesn’t exist, it is possible that the file is still actually there and someone or something has messed up your access rights. Or it could just be that the ‘find’ is discovering a memorised link to the now non-existent file.

---

<div class="post-metadata">

**Author:** ![overlyverbose](https://avatars.discourse-cdn.com/v4/letter/o/9dc877/32.png) [@overlyverbose](https://boards.straightdope.com/u/overlyverbose)\
**Post date:** [September 22, 2004, 8:42pm UTC](https://boards.straightdope.com/t/any-way-to-tell-if-a-document-was-deliberately-deleted/265549/5 "2004-09-22T20:42:34Z")

</div>

> [@Sat on Cookie](#):
>
> I guess that’s part of my question – so it _is_ possible for someone having access to the network to retrieve the document and see what happened?

If your company backs its drives up every day (and most companies do), it should be possible for someone to retrieve a document from the server, though you’ll have to ask someone in IT to do it because it’s probably password protected so someone can’t delete things off the network that everyone uses.

Also, do you each have personal drives that are password protected in addition to your network (common) directory? If so, next time your co-worker might want to save a copy in her drive as well. If she’s really worried about this person, she might want to save a copy to disc, too.

Also, tell her to document the event, just in case the troll causes future problems.

---

<div class="post-metadata">

**Author:** ![MikeS](https://avatars.discourse-cdn.com/v4/letter/m/919ad9/32.png) [@MikeS](https://boards.straightdope.com/u/MikeS)\
**Post date:** [September 22, 2004, 10:36pm UTC](https://boards.straightdope.com/t/any-way-to-tell-if-a-document-was-deliberately-deleted/265549/6 "2004-09-22T22:36:24Z")

</div>

> [@Sat on Cookie](#):
>
> We have IMacs (gag), the document was in word and she saved it to a network folder. Upon returning to the office after being out for a few days, the document is no longer in the folder. She did a “find file” and the doc was found but when she goes to pull it up, it says the doc doesn’t exist.

Yeah, I’ll agree with you that the iMac isn’t the best. You’re much better off with one of the new G5 Towers. 🙂

> [@Mangetout](#):
>
> Or it could just be that the ‘find’ is discovering a memorised link to the now non-existent file.

I strongly suspect that this is the case. Most Macs are set up to have a “Recent Files” folder in the Apple Menu in the Finder; Mac OS does this by saving aliases to the files you open in a special directory in your System folder (aptly named “Recent Files”.) A search on the old filename will still return the alias, since it’s got the same name as the original file; but the alias in the “Recent Files” directory is just a pointer to the real file, and if the real file is deleted you’ll get an error message.
