Only problem is that the file is deleted. We are looking at stuff in the unallocated area, hence my original post. Is there any way to tell when the file was downloaded by those values I mentioned before, thats all we have ...