I don't even know where to start. A user contacts me and says today that she worked on a powerpoint presentation all day yesterday and clicked save throughout the day. Closed the file after clicking save and went home. She came in today and said the file reverted to a previous version. When you look at the last modify date it is Jan 16th. The file appears in the office file recovery folder but it too is the version from Jan 16th. However it's dated Feb 12th 8:34am.

So it proves she opened it but what the ... happened? Is this even possible? I guess anything is possible but how do you figure something like out.

It's office 365 (2013 Pro plus) running on a windows 2008 r2 terminal server with Citrix xenapp 7.6. The file is stored on a server 2012R2 file share.

I didn't have shadow copies turned on but when ahead and turned it on starting at 7AM to run for 12 hours every 2 hours. I gave it 15Gb.

Thanks,
John Long

• Edited by jlongjr Friday, February 13, 2015 10:07 PM

It's happened quite a few times. It's also happening on her PC too. Not just the terminal server. She also says she is loosing sent email. She'll send an email and it doesn't appear in her sent items. There is no log of it on the server, we also have journaling enabled and use Mimecast to archive our email and it's not there.

I turned on shadow copies on the server to try to capture the files she's saving, I set shadow copies to 30 minutes. I told her to save everything to the server but the last time this happened she saved it to the desktop. Then she complained that it's too hard to save stuff to the server. Ugh.

Can anyone recommend some software that records absolutely everything she does on her computer? Something like a DVR that we can see these events happen?

 

• Edited by jlongjr 19 hours 53 minutes ago