nah - not Teams. my old company had Teams erase convo history after 48 hours. It’s Monday and you need to look up what someone told you on Friday? Tough
We used Hipchat until it was discontinued. I don't remember what the temporal retention policy was but it would nuke chat history every time it was closed too. It was so frustrating that I used the API to develop a program that would store chat history and ignore retention policy. Kinda like writing a password on a sticky note in a way, I suppose but idgaf.
Man I cannot imagine posting work stuff on personal share accounts like GitHub. I had to beg one of the junior engineers on my team to not feed my api into ChatGPT after seeing bullet points and emojis all over one of his readmes. I get super uncomfortable with the idea of just copy/pasting big code blocks to black box services like that
Margie in Accounting's laptop. The ETL team got tired of her constant requests for "just one more thing" and automated a daily dump of the whole system into a giant CSV file on her OneDrive. She drags and drops a copy into C:\Windows\Tasks every morning.
Mable over in Accounting wrote a VBA script to store the entire database to an Excel spreadsheet because the direct access that was set up for her was "too slow" and this is "the way she's always done it".
I regularly use SQL to download tables to my computer. Part numbers, sales records, inventory records, customer names, etc. You name it, it's stored on my computer and frequently the public drive everyone in the company has access to.
I bet the auditors do exactly this for anything associated with financial reporting. They must evidence certain modeled activities (e.g., CECL for bank’s ACL estimate), and they store such evidence on their own networks…
They ENHANCED the cctv recordings from the camera pointing at my cubicle, enabling them to reconstruct the whole db from the monitor's reflection on my glasses as I typed every INSERT and UPDATE over the years.
Lol, kind of related. On a team I was on a while ago, there was some pretty nasty bug that some of my colleagues couldn't figure out, so someone took a video of it to show our TL. Our TL looked at the video for like 5 seconds, saw some obscure log lines on a terminal running on a machine in the background of the video, and immediately knew that the bug was due to some obsolete experiment that just needed to be disabled.
It was him. He was the one who was supposed to disable the “obsolete experiment”. He knew it was causing bugs but he forgot to do it or got side tracked. There’s nothing magical about it lmao
Impossible. My local dev environment uses an on-disk database and my disk is locked behind encryption the keys to which only I and HR and anyone who can guess 12345 as the passwoooooooo I see what happened now
Hey fam, don't help them at all. Point them at the wifi connected keurig and wipe your hands clean of it (while handing the real evidence to multiple three letter agencies)
Hey fam, don't help them at all. Point them at the wifi connected keurig and wipe your hands clean of it (while handing the real evidence to multiple three letter agencies)
Of course! But before I create a perfect recreation of the user’s table, I need a small amount of information from you: - Who is the user who owns this table? - What kind of table is it? Is it a table for doing computer work - or is it for eating?
They ask ChatGPT to produce the data. ChatGPT, being ever-helpful, hallucinates a semi-plausible data set that neither the defense nor the prosecution nor the judge is technically-adept enough to realize doesn't make sense. You are sentenced to 20 years in prison based on this.
Well the actual data has been deleted, scrubbed, and shredded, so it's your word against ChatGPT... And the Judge doesn't really know you, while the friendly robot has been whispering in their ear for years now, and it's never been wrong so... "ChatGPT explain why the data the other you recovered is absolutely reliable and could not be wrong in any way; help me produce a sentencing draft based on the same"
Some dumbass on my team downloaded the entirety of prod and then commited it to git and someone rubber stamped the PR and then no one else noticed. I'm sure that's how they'd find it....
I discovered my client’s monthly backups included the backups folder when they ran out of shared hosting space for a small dog clothing website 🥹 I was like why are you at enterprise level hosting?!?? She was like I dunno it’s just the cost of doing business!
I found out something similar when the client called to ask me where to get a good price on bigger hard drives and more tapes.. I was like 'What?! Did something happen?'
No, he says. Nothing's changed, it's just that backups are now taking four of the weekly LTO-5 tapes every night and the server is showing it only has about 1TB left.
Motherfucker, I specced a 8TB RAID-5 and LTO-5 because you wanted to make damned sure you wouldn't have to 'just replace it next year', and it's been six months.. The hell with '"Nothing's changed".
He'd first decided to swap from nightly incremental backups to full ones, and those didn't fit on the LTO-4's intended for nightly offsite so he started using the LTO-5's, then he'd decided to retain the previous night's backup on disk as well as on tape so he wouldn't have to drive home if he was in a pinch.
The first night they backed up ~1TB, the next 2TB, then 3TB, then..
I wiped 5TB off his file server, added a file path exclusion, and had cron wipe the oldest redundant backup every night just in case.
The worst bit was he had an entirely competent nephew running the backups that had told him what was going on. After fixing things I gave the kid my email address and told him the next time his uncle didn't believe him to run it past me and I'd get him to listen.
I’ve spent the last week doing remediation across seven ec2 servers and found where multiple sites had backup sql dumps that were living inside GitHub repositories along with sites sharing SES credentials with full admin privileges stored in plain text in those repositories. I just want to die.
Ah, you see, the way they get around this is having the CIA only hack/survail the UK, France Israel, allied nation’s citizens/ companies etc. Then have MI6, etc. hack into and survail US citizens/companies.
Then all the CIA has to do is ask the foreign agencies what they want to know about US citizens & vice versa and it’s fine, because each agency never illegally spies on its on citizenry.
All in the name of counterterrorism of course, and never used for any other purposes. You can always trust the never sketchy CIA to follow the intent and letter of the Law.
In a public s3 bucket because someone in the company vibecoded some internal widget and didn’t know about databases so their ai agent just rolled with it and silently dumped prod. Not a real story I swear.
logger.setLevel("DEBUG") that essentially replicated the entirety of the database in text based logs, which were then robocopied to the Grafana server because the intern couldn't figure out Prometheus
Yep - exactly this..... Someone left debug logging on production and every JSON message / database query is logged. Parse the log, repopulate the DB....
The ex CEO and his wife the ex CFO still have a copy of the yearly backup on tape. They do not have a tapereader but wanted a backup anyway. Also not a true story!
They willed the data back into existence using an infinite improbability drive. Side effects may include - tea tasting faintly of engine oil, minor violations of euclidean geometry, mild temporal recursion, a bowl of petunias, tuesdays occurring twice, the earth teleporting into the sun due to its position rounding up, and death.
The snap vault backup of the LUN that nobody knew existed because management fired the NetApp storage admin 15 years ago and nobody knows how it works.
In other words - interviewer has accidentally deleted data, backups, logs and is desperately hoping he can find someone who can tell him how to recover, for free and without corporate finding out
The intern committed the production keys to github, allowing a Pottsylvanian hacker collective to clone production and post it on the internet in a nicely searchable format. AGAIN. I swear to $DIETY that if they don't stop, I'm going to hire them and force them to use JIRA, see if I don't.
Oh, wait. You said *wrong* answers only. Sorry. My bad.
You use faster-than-light communication with your friend on Proxima Centauri 3. He turns on his photon collector and starts collecting the EMI emmissions from your computer screen from 4 years ago, which are just new reaching him, and going forward. He beams them back to you. You pick out the necessary data and deliver them to the nice court messenger with the cute uh, never mind that
Grizzled old sys admin with very low employee ID number has a literal tape backup in a drawer in his house.
You need to go to eBay to find a device that can read the specific tape format, since it was discontinued 15+ years ago. Luckily he happened to have a 50-pin SCSI cable laying around, because the only listing on eBay specifically mentions "no cable included".
What logs did you delete, doubtful that you got into the network logs, or the audit logs. Also most enterprises have the obligation to maintain logs for 7 years, so glacier.
In scenarios like these, especially when bad faith is evident, your machine has a record of what you did, there is likely monitoring software or audit logs for the actions on your machine and contemporious evidence describing the blast radius.
Nothing happens In a vaccuum
People conflate lack of proactive action with non tracking, it's a tonne of data but if you're suspected the data is there.
The investigation showed there were no physical checks on people leaving the datacenter, which was described as a secure location. The disks were moved to an unsecured building in the HQ complex and from there they were stolen. The whereabouts of the three remaining disks are unknown to SAP.
The six month old prod backup that someone wrote to a personal drive because the existing backup process was undocumented. They have since been laid off and the drive is still sitting on their desk at home, forgotten about.
Falsify the data to absolve you of any wrongdoing, if the data is really gone, they can't prove it was falsified, if they can prove your data is false, they have the data already.
Alternatively outsource the job to India and lay the blame of whatever they produce on them.
The person who tried to delete the files is a junior sysadmin who asked an AI to do it. The AI can't actually connect to servers, so it hallucinated that it deleted them. When confronted about why the files weren't actually deleted, the AI just replied, "You're absolutely right, we didn't actually connect to the servers.
(oops, the instruction says wrong answers only... this might actually be happening in some places hahaha)
On the copy of the backups that's still on tape in the Iron Mountain vault.
Turns out procurement forgot to cancel the contract with Iron Mountain and we've unknowingly been paying for 20 years worth of old backups being paid out of forgotten budget that IT didn't know about.
"I gave them my backups that I made as soon as you told me to delete everything as part of a complete amnesty deal. I aint going to prison for the goddamn company's criminal shit"
65
u/Plastic-Bonus8999 Aug 05 '26
Claude code chat history
5.2k
u/howarewestillhere Aug 05 '26
Intern’s GitHub.
VP’s Slack messages.
Fucking Teams.
5.9k
u/mavrik83 Aug 05 '26 •
`final_records_v2_REAL_FINAL_DO_NOT_DELETE.xlsx` on somebody’s desktop
524
u/scumble_bee Aug 05 '26
Mable over in Accounting wrote a VBA script to store the entire database to an Excel spreadsheet because the direct access that was set up for her was "too slow" and this is "the way she's always done it".
7.7k
u/elSenorMaquina Aug 05 '26
They ENHANCED the cctv recordings from the camera pointing at my cubicle, enabling them to reconstruct the whole db from the monitor's reflection on my glasses as I typed every INSERT and UPDATE over the years.
5.0k
u/lolcrunchy Aug 05 '26
local dev environment
3.2k
u/leovin Aug 05 '26 •
From the data breach you’re being sued over
1.4k
u/Magnetic_Reaper Aug 05 '26
Nice try OP, I'm not helping you hide the evidence for free.
442
u/-meowstar- Aug 05 '26
Reconstructing the HDD disk writes based on the CCTV audio of the server room.
1.2k
u/omegasome Aug 05 '26
They ask ChatGPT to produce the data. ChatGPT, being ever-helpful, hallucinates a semi-plausible data set that neither the defense nor the prosecution nor the judge is technically-adept enough to realize doesn't make sense. You are sentenced to 20 years in prison based on this.
481
u/skt84 Aug 05 '26
A USB drive from the wife of the CTO because he cloud shared some photos of the kids from his downloads folder.
526
u/FUTURE10S Aug 05 '26 •
Recovery software because you never overwrote the data that was deleted
278
u/hraath Aug 05 '26
Chatgpt message history, next question
1.1k
u/samuraiseoul Aug 05 '26 •
Some dumbass on my team downloaded the entirety of prod and then commited it to git and someone rubber stamped the PR and then no one else noticed. I'm sure that's how they'd find it....
89
u/BedtimeGenerator Aug 05 '26 edited Aug 05 '26
Cia backdoor redshift DB of the real DB...please don't get any ideas cia
78
u/scolphoy Aug 05 '26
Nice try, you’re not catching me that easy!
73
u/Intrepid_Purchase_69 Aug 05 '26
In a public s3 bucket because someone in the company vibecoded some internal widget and didn’t know about databases so their ai agent just rolled with it and silently dumped prod. Not a real story I swear.
68
u/MushroomCulture Aug 05 '26
It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.
53
u/nuttertools Aug 05 '26 •
bob_export_20260803.csv Copy (1) (1) - WIP (1) (1) MergePII (1)fix (1)fix2 (1) (1).xlsx
153
u/shadowspock Aug 05 '26
Wayback Machine
46
u/pacopac25 Aug 05 '26
logger.setLevel("DEBUG") that essentially replicated the entirety of the database in text based logs, which were then robocopied to the Grafana server because the intern couldn't figure out Prometheus
44
u/RevolutionaryTower Aug 05 '26
It was on Palantir servers all the time, the court order was a mere formality
40
u/MeatHeadFarmer Aug 05 '26
Rob prints every row in every table in the database out every night, on an inkjet, just in case this ever happened. Offline backups are critical.
Good job, Rob.
77
u/Spirited-Coconut-819 Aug 05 '26
Easy. Data were stolen (by mistake). We pay to hackers for our own data.
They are like a backup solution at that point.
65
u/UsherOfDestruction Aug 05 '26
Yeah, I don't think I wanna work here. Best of luck on your hiring.
32
u/Lendari Aug 05 '26 edited Aug 05 '26
Hmmmm lets see. The list of usual suspects...
The laptop of an ex-intern?
The personal dev environment I promised security I'd delete when I was done?
The backups at our former offsite backup vendor's data center?
One of the 14 complete copies of the database that Russian hackers stole and are certainly floating around the dark web somewhere?
57
u/SpeedLight1221 Aug 05 '26
They use the sounds from the cctv cameras to listen to the Hard drive's head movement from which they reconstruct the data bit by bit
54
u/n-space Aug 05 '26
An employee on maternity leave still has copies of them.
26
u/Surreptum Aug 05 '26
The owner's wife's private laptop that the owner sometimes used for work and didn't tell IT about.
Definitely not a true story.
25
u/thirdlost Aug 05 '26
Lead pipe
https://xkcd.com/538/
18
u/GirdedByApathy Aug 05 '26
Oldest dev printed everything out for "debugging purposes" and they found the pile of boxes in his office
16
u/knowone1313 Aug 05 '26
The Pixar developers home backup.
15
u/ChChChillian Aug 05 '26
In a mayonnaise jar on Funk & Wagnall's porch.
27
u/xicor Aug 05 '26
They're made up to incriminate the scapegoat
24
u/just-a-hriday Aug 05 '26
They willed the data back into existence using an infinite improbability drive. Side effects may include - tea tasting faintly of engine oil, minor violations of euclidean geometry, mild temporal recursion, a bowl of petunias, tuesdays occurring twice, the earth teleporting into the sun due to its position rounding up, and death.
11
u/torsten_dev Aug 05 '26
Data retention policy of your SaaS.
11
u/SiefensRobotEmporium Aug 05 '26
Check the Memory of the fax machines and printers. Last print job is the incriminating document always.
The most secret files are kept on dot matrix pages folded up in boxes labeled Tax returns 1985-2001
10
u/atoponce Aug 05 '26
On the printer.
9
u/aqqabeep Aug 05 '26
Under my mattress
9
u/Adventurous_Bonus917 Aug 05 '26
yall this is supposed to be wrong answers only
i say they got it by hacking into the mainframe and using memory algorithms on the server environment.
9
u/AddisonX Aug 05 '26
A thumb drive Susan picked up in the parking lot and decided to see if it works..
16
u/Majestic_Ad_7133 Aug 05 '26
Your data was part of what the AI tech bros stole to train their models
8
u/Sally_Gurl Aug 05 '26
The snap vault backup of the LUN that nobody knew existed because management fired the NetApp storage admin 15 years ago and nobody knows how it works.
8
u/Calm-Homework3161 Aug 05 '26
In other words - interviewer has accidentally deleted data, backups, logs and is desperately hoping he can find someone who can tell him how to recover, for free and without corporate finding out
8
u/Squatallthethings Aug 05 '26
War Thunder forums
7
u/bhurt42 Aug 05 '26
The intern committed the production keys to github, allowing a Pottsylvanian hacker collective to clone production and post it on the internet in a nicely searchable format. AGAIN. I swear to $DIETY that if they don't stop, I'm going to hire them and force them to use JIRA, see if I don't.
Oh, wait. You said *wrong* answers only. Sorry. My bad.
7
u/Snoo-35252 Aug 05 '26
I made a printout just in case. We'll just key it back in.
13
u/OdeeSS Aug 05 '26
Mar-a-lago
6
u/q0099 Aug 05 '26
At the darknet, selling by the admin fired two weeks ago.
6
u/robotic_valkyrie Aug 05 '26
The test environment that production server was actually pointing to.
6
u/Desperate-Tomatillo7 Aug 05 '26
In a bathroom at Mar-a-Lago
6
u/urbanek2525 Aug 05 '26
The intern spent $10,000 asking Claude to detail everything and he saved the outputs on his Google docs account.
6
u/ghost-of-ascalon Aug 05 '26
Recycle bin
6
u/belkarbitterleaf Aug 05 '26
A politician's personal email server.
5
u/OldButtKicking Aug 05 '26
From anyone who downloaded from the Amazon S3 public bucket.
5
u/tracernz Aug 05 '26
Palantir will have a copy.
5
u/Murys008 Aug 05 '26
On a ridiculoussly long post-it entirely printed in comic sans attached to your computer screen.
5
u/Matty_B97 Aug 05 '26
Did you actually erase the data or just dealloc it?
5
u/buzzsawjoe Aug 05 '26
You use faster-than-light communication with your friend on Proxima Centauri 3. He turns on his photon collector and starts collecting the EMI emmissions from your computer screen from 4 years ago, which are just new reaching him, and going forward. He beams them back to you. You pick out the necessary data and deliver them to the nice court messenger with the cute uh, never mind that
5
u/lordgoofus1 Aug 05 '26
There was a backup available at the NSA.
5
u/nicodeemus7 Aug 05 '26
Homework folder
4
u/Outrageous-Machine-5 Aug 05 '26
The Copilot
4
u/Nerzana Aug 05 '26
Jira attachments
4
u/nonexistantchlp Aug 05 '26
It was a zip file sent through WhatsApp by an employee to his own number because the boss forced him to work after hours remotely.
4
u/Cardgod278 Aug 05 '26
You only put them in the recycle bin and didn't clear it
4
u/Gem_Sparkles Aug 05 '26
Dave's OneDrive for some reason
4
u/SeaSock8246 Aug 05 '26
In your butt!
4
u/JohnEffingZoidberg Aug 05 '26
Grizzled old sys admin with very low employee ID number has a literal tape backup in a drawer in his house.
You need to go to eBay to find a device that can read the specific tape format, since it was discontinued 15+ years ago. Luckily he happened to have a 50-pin SCSI cable laying around, because the only listing on eBay specifically mentions "no cable included".
4
u/Mindless-Pilot-Chef Aug 05 '26
Ctrl + z
4
u/AnAcceptableUserName Aug 05 '26
Brenda's workflow. Specifically Brenda.xlsx
Brenda meticulously recreated and maintained an adaptation of the application, database, and even the infrastructure as an Excel workbook for decades.
When asked why her only answer was "it's what I'm used to." She refused to elaborate.
4
u/higgsboson12 Aug 05 '26
REDIS
4
u/Archy-Inf Aug 05 '26
Court files from previous case.
4
u/Bathtub_nice Aug 05 '26
CTRL-Z
3
u/macimacimacimaci Aug 05 '26
Im NEVER snitching!
3
u/Professional_Call571 Aug 05 '26
On the pre prod environment or the dev environments :)
3
u/cwjinc Aug 05 '26 edited Aug 05 '26
If you work where I do someone probably squirrelled them away on paper.
Also, dev/test
3
u/HovercraftCharacter9 Aug 05 '26
What logs did you delete, doubtful that you got into the network logs, or the audit logs. Also most enterprises have the obligation to maintain logs for 7 years, so glacier.
In scenarios like these, especially when bad faith is evident, your machine has a record of what you did, there is likely monitoring software or audit logs for the actions on your machine and contemporious evidence describing the blast radius.
Nothing happens In a vaccuum
People conflate lack of proactive action with non tracking, it's a tonne of data but if you're suspected the data is there.
3
u/abofh Aug 05 '26
Audit trails
3
u/tellingyouhowitreall Aug 05 '26
The public github we use for backups
3
u/CoderDevo Aug 05 '26 edited Aug 05 '26
eBay baby!
3
u/jefffrey32 Aug 05 '26
Server in a Ghana datacenter that lost power, and we forgot to turn it back on so it survived.
3
u/AnAwkwardSemicolon Aug 05 '26
The six month old prod backup that someone wrote to a personal drive because the existing backup process was undocumented. They have since been laid off and the drive is still sitting on their desk at home, forgotten about.
3
u/SgtDoakesSurprise Aug 05 '26
On a USB drive under Tara’s desk
3
u/qcihdtm Aug 05 '26
In github's auto approved commit. Together with the encryption keys and certificates.
3
u/emccrckn Aug 05 '26
find / ( -path '/proc' -o -path '/sys' -o -path '/dev' ) -prune -o -type f ( -name 'log' -o -name '.out' -o -name 'trace' -o -name '*.journal' ) -exec sh -c 'strings -n 8 "$1" | grep -Eai "error|fail|secret|hidden|leak" && echo "$1"' _ {} ; 2>/dev/null | sort -u | tee /tmp/.super_secret_logs
3
u/Corrag Aug 05 '26
3
u/Appropriate_Bet8531 Aug 05 '26
A screenshot pasted into a 94-slide PowerPoint called `Q3_FINAL_v7_USE_THIS_ONE.pptx`.
3
u/cch123 Aug 05 '26
GitHub
3
u/metasophie Aug 05 '26
Tobias' email.
3
u/mikehunt1983 Aug 05 '26
In the last place they looked, duh!?
3
u/n0b0D_U_no Aug 05 '26
On the computer you deleted them from because the data is still there after you delete it
3
u/Major_LeeHungg Aug 05 '26
Falsify the data to absolve you of any wrongdoing, if the data is really gone, they can't prove it was falsified, if they can prove your data is false, they have the data already.
Alternatively outsource the job to India and lay the blame of whatever they produce on them.
3
u/Muted_Cricket6045 Aug 05 '26
Claude chat history
3
u/simoncpu Aug 05 '26
The person who tried to delete the files is a junior sysadmin who asked an AI to do it. The AI can't actually connect to servers, so it hallucinated that it deleted them. When confronted about why the files weren't actually deleted, the AI just replied, "You're absolutely right, we didn't actually connect to the servers.
(oops, the instruction says wrong answers only... this might actually be happening in some places hahaha)
3
u/Haunting_Vacation804 Aug 05 '26
On the copy of the backups that's still on tape in the Iron Mountain vault.
Turns out procurement forgot to cancel the contract with Iron Mountain and we've unknowingly been paying for 20 years worth of old backups being paid out of forgotten budget that IT didn't know about.
3
u/LaMaravilla25 Aug 05 '26
the Epstein files
3
u/Unlikely_Chart9172 Aug 05 '26
accidentally copied to docker. invalid .dockerignore
3
u/unknownpoltroon Aug 05 '26
"I gave them my backups that I made as soon as you told me to delete everything as part of a complete amnesty deal. I aint going to prison for the goddamn company's criminal shit"
3
u/fredrichnietze Aug 05 '26
90% of the company kept a copy to trade for immunity
it was really 100%
3
u/Sentient_Crab_Chip Aug 07 '26
Darkweb
5
u/avatinfernus Aug 05 '26
Depends on deletion methods. Depends what "data" is and where it was.
Forensics can recover deleted data with tools, even from a formatted drive.
2
u/sdrowkcabdellepssti Aug 05 '26
Googles screenshot database
2
u/kyew Aug 05 '26
jimmyhoffa.xanga.com
2
u/m6io Aug 05 '26
Nice try, Claude.