Finding out when files were deleted.

Archived from groups: microsoft.public.win2000.security (More info?)

How can one find out when files were deleted? They have since been
recovered, but it is important to know when (who) deleted them.

Any help is much appreciated

Roger

..
2 answers Last reply
More about finding files deleted
  1. Archived from groups: microsoft.public.win2000.security (More info?)

    If you were not auditing Delete actions on those files, then
    there is no record of when/who. Due to the large volume of
    events that could result, auditing of NTFS actions must be
    defined according to your needs - there is none in the default.

    --
    Roger Abell
    Microsoft MVP (Windows Security)
    MCSE (W2k3,W2k,Nt4) MCDBA
    <somebody@compusmart.ab.ca> wrote in message
    news:6351v09gprd8tse3d7pv84rirdsbidvnhd@4ax.com...
    > How can one find out when files were deleted? They have since been
    > recovered, but it is important to know when (who) deleted them.
    >
    > Any help is much appreciated
    >
    > Roger
    >
    > .
  2. Archived from groups: microsoft.public.win2000.security (More info?)

    "Roger Abell" <mvpNOSpam@asu.edu> wrote:

    >If you were not auditing Delete actions on those files, then
    >there is no record of when/who. Due to the large volume of
    >events that could result, auditing of NTFS actions must be
    >defined according to your needs - there is none in the default.

    Many thanks for the info. NTFS actions are not audited - we'll never
    know who did it.

    Roger
Ask a new question

Read More

Security Microsoft Windows