Windows 8 and 8.1 Forums


Can you view previously copied data?

  1. #1


    Posts : 149
    Windows 8 Pro

    Can you view previously copied data?


    We have an employee who we believe may have backed up sensitive information to a personal flash drive.

    We run Windows 7 professions on 2012 R2 server.

    Is there a way that I can check to see what was copied to an external drive? If so, how?

      My System SpecsSystem Spec

  2. #2


    Posts : 454
    Windows 8.1 Pro with Media Center


    Sector editors like WinHex and HxD will open a disk and let you search the whole thing sector by sector, without regard to file systems. If you want to wipe the drive, flash drives have their own set of considerations. See the paper Schneier linked to here:

    https://www.schneier.com/blog/archiv...g_data_fr.html

    SSDs with TRIM enabled in effect self-sanitize over time when files are deleted.
      My System SpecsSystem Spec

  3. #3


    Posts : 149
    Windows 8 Pro


    Quote Originally Posted by crawfish View Post
    Sector editors like WinHex and HxD will open a disk and let you search the whole thing sector by sector, without regard to file systems. If you want to wipe the drive, flash drives have their own set of considerations. See the paper Schneier linked to here:

    https://www.schneier.com/blog/archiv...g_data_fr.html

    SSDs with TRIM enabled in effect self-sanitize over time when files are deleted.
    I appreciate that. I have no experience with this software. Do I simply install and search? Is there something specific I should look for to see what was copied in the last week from HD to external? I am just wanting to see what folders were copied, not necessarily all files.
      My System SpecsSystem Spec

  4. #4


    Posts : 454
    Windows 8.1 Pro with Media Center


    If you open a disk in file system mode in WinHex, it will show deleted files and folders with dimmed icons beside them containing a question mark. See also undelete programs, which I would assume give you a consolidated list of deleted files/folders to try to restore. You still need to search for contents, though, because it's possible that the file system structures will be overwritten while data from the files remains on the disk.
      My System SpecsSystem Spec

  5. #5


    Posts : 149
    Windows 8 Pro


    Quote Originally Posted by crawfish View Post
    If you open a disk in file system mode in WinHex, it will show deleted files and folders with dimmed icons beside them containing a question mark. See also undelete programs, which I would assume give you a consolidated list of deleted files/folders to try to restore. You still need to search for contents, though, because it's possible that the file system structures will be overwritten while data from the files remains on the disk.
    Thanks, but the info wasn't deleted, it was copied. I am just attempting to find a log that says on this date this folder was copied to this drive. Is it not that in depth, or does it do that as well? Thanks again!
      My System SpecsSystem Spec

  6. #6


    Posts : 454
    Windows 8.1 Pro with Media Center


    There won't be a log for that, but you could open File Explorer to the root of the drive, enter * as the search term, and perform the search. Explorer will display a flat listing of all the folders and files which you can sort in various ways. You might also want to turn on the display of hidden files before doing this.
      My System SpecsSystem Spec

  7. #7


    Posts : 149
    Windows 8 Pro


    Quote Originally Posted by crawfish View Post
    There won't be a log for that, but you could open File Explorer to the root of the drive, enter * as the search term, and perform the search. Explorer will display a flat listing of all the folders and files which you can sort in various ways. You might also want to turn on the display of hidden files before doing this.
    last question. How do I open File Explorer to the root of the drive? I know how to open it, but not to the root of the drive.
      My System SpecsSystem Spec

  8. #8


    Yellow Belly
    Posts : 178
    Windows 8.1 with Bing x64


    The other way you could try is to view the Last Access Date and Time for files you are concerned about. This facility could be disabled by default though.

    You can open to the root just by double-clicking on the C: drive icon in File Explorer
      My System SpecsSystem Spec

  9. #9


    Posts : 149
    Windows 8 Pro


    I searched the C drive with * but am not sure how to determine what files had recently been copied to an external device.
      My System SpecsSystem Spec

  10. #10


    Posts : 2,627
    win8.1.1 enterprise


    Quote Originally Posted by stringjunky View Post
    The other way you could try is to view the Last Access Date and Time for files you are concerned about. This facility could be disabled by default though.

    You can open to the root just by double-clicking on the C: drive icon in File Explorer
    that I think would only work if the person opened the files before they copied them to the external device .

    to the best of my computer knowledge there is no way of knowing what folders or files the person may have copied to the external device
      My System SpecsSystem Spec

Page 1 of 2 12 LastLast
Can you view previously copied data?
Related Threads
Hi everyone, The problem is the next: I have new PC for that i was asked to setup and install software, i perform on it clean windows 8 install, it have single HDD 1TB that was partitioned by regular windows setup option to system drive C: 100GB and all left space was partitioned as drive D:...
I'm still not sure what happened but a few weeks ago all of my tiles disappeared. I did a clean boot, but did not find any issue. I then refreshed my PC, but the problem still persists. All the apps that I had downloaded before 'the disappearance' are in my windows store as 'already installed.' But...
Last night, I enabled File History, and when I returned to my computer this morning I found that it had created copies of 1.14TB of my 1.19TB of data on the backup drive I had specified. However, it seems like the process has stopped, as every time I click the "Run Now" button, no new data is...
Is there a way to make Windows 8 remember what screen you closed a program on and open it in that window? Right now, I have most of the stuff I open pinned to the task bar. How it opens now is what ever monitor I click on the program in, it opens it in that monitor. I understand the logic on that,...
I have a Compaq Presario f500 laptop which had vista on it when I bought it a few years ago. It currently has Pclinuxos on it, but I'd like to install Windows 8, if possible, so I can run Photoshop and lightroom. It's marginal in terms of specs for Windows 8 I think, in that it only has 1 Gb...
Eight Forums Android App Eight Forums IOS App Follow us on Facebook