issue please help

I have never come across a log on a CD

I would expect the text file to still be on the hard drive. It would be very dangerous for any software to delete files, even if the burning was confirmed as OK.

i have an issue please
1-i was running windows xp ,
2-there was txt file in a drive i created it ,,, i saved on it many times
3-i copied the file to a cd through windows
4- now i have the file on a cd
5- i don't have the hard disk now i only have the cd
6-i want to know if the file has been moved or copied from folder to folder before it burned
isn't there any log file data (or any thing in the file on the cd) to tell me if the file has been copied before burnt or not

i think the drive was ntfs ,, i am searching but i dunno where to begin ,, thanks

If you don't have access to the hard drive any longer there really is no way for you to know if it has been moved prior or after the fact you burned the CD. The CD itself is static and retains to no log of access, those logs reside of the systems that access it.

If you did have access to the drive, and maybe this is what you are trying to ask, or if someone else currently has access to the drive and wanted to know if you had moved/copied the file around then yes there are several ways for them to determine where it was.

Scenario 1 The multiple files were never deleted
This is the easiest scenario as someone would just have to parse the MFT and find all the copies of the file in their respective directories.

Scenario 2 Some of the copies of the text file were recently deleted
The $logfile may still contain references to the copies of the file that were deleted in addition to the MFT until the next time a defrag is ran or the entry is overwritten. Any copies not deleted are still available within the MFT.

Scenario 3 Some of the copies of the text file were deleted some time ago and the system was in active use
At this point you'll need to rely on artifacts that show the text file was in use stored in the active system and restore points such as LNK files and MRU's as an example. Each opening and editing of the text file should have updated these values.

Remember that the CD Burn itself is separate from your question and is also detectable.

I hope that helps.

i have now the hard disk ,,, the windows have been formatted after it , i think for 2 times ,,, how can i solve this situation ,,

Your only hope is to scan the hard drive for any MFT entry with the required file name. You can then tell if the file had been deleted.

A double (quick) format may not be a problem, but it depends how many files have been written since formatting.

If one of the formats was a full format, you have lost the info for ever.

If one of the formats was a full format, you have lost the info for ever.

Not on XP, only in Vista or later.

jaclaz

(Your only hope is to scan the hard drive for any MFT entry with the required file name.)
how can i do that ,,, sorry i am newbie

(Your only hope is to scan the hard drive for any MFT entry with the required file name.)
how can i do that ,,, sorry i am newbie

You use *any* suitable tool.
At the very minimum you use a hex/disk editor, you go to the beginning of the $MFT (on cluster 786432 on *any* NTFS filesystem bigger than 5 or 6 Gb) and start searching for the filename.
You can try using DMDE
http//dmde.com/
and see if it can find the file as "deleted".

jaclaz

on cluster 786432

0xC0000 is much easier to remember than 786432

Some drives, the $MFT starts at cluster 4 (same in hex and decimal) lol

i got this how can i search for the name of the file in the mtf ,
thanks in advance