Tom's Hardware > Forum > Windows 2000/NT > Windows 2000/NT General Discussion > Finding out when files were deleted.
Ask the community Add a reply
Word :    Username :           
 
somebody   01-21-2005 at 11:46:37 AM

Archived from groups: microsoft.public.win2000.security (More info?)

 

How can one find out when files were deleted? They have since been
recovered, but it is important to know when (who) deleted them.

Any help is much appreciated

Roger

..

Add a reply
Sponsored Links
Register or log in to remove.
Anonymous   01-21-2005 at 11:46:38 AM
- 0 +

Archived from groups: microsoft.public.win2000.security (More info?)

 

If you were not auditing Delete actions on those files, then
there is no record of when/who. Due to the large volume of
events that could result, auditing of NTFS actions must be
defined according to your needs - there is none in the default.

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
<somebody@compusmart.ab.ca> wrote in message
news:6351v09gprd8tse3d7pv84rirdsbidvnhd@4ax.com...
> How can one find out when files were deleted? They have since been
> recovered, but it is important to know when (who) deleted them.
>
> Any help is much appreciated
>
> Roger
>
> .

Reply to Anonymous
somebody   01-21-2005 at 07:33:38 PM
- 0 +

Archived from groups: microsoft.public.win2000.security (More info?)

 

"Roger Abell" <mvpNOSpam@asu.edu> wrote:

>If you were not auditing Delete actions on those files, then
>there is no record of when/who. Due to the large volume of
>events that could result, auditing of NTFS actions must be
>defined according to your needs - there is none in the default.

Many thanks for the info. NTFS actions are not audited - we'll never
know who did it.

Roger

Reply to somebody
Ask the community Add a reply
Tom's Hardware > Forum > Windows 2000/NT > Windows 2000/NT General Discussion > Finding out when files were deleted.
Go to:

There are 1170 identified and unidentified users. To see the list of identified users, Click here.

Forum map
Bestofmedia Forum ©
2000-2009 Bestofmedia Group
Page generated in 0.298 seconds
Please mind

You are about to answer a thread that has been inactive for more than 6 months.
If you still wish to proceed, please ensure that your posting is original and does not duplicate or overlap any prior responses to this thread.

Add a reply Cancel
Sponsored links
  • Ask the community now
  • Publish
Ad
Related Topics
See all relatives topics
They won a badge
Join us in greeting them
How do I win badges?