Sign in with
Sign up | Sign in
Your question

Finding out when files were deleted.

Last response: in Windows 2000/NT
Share
January 21, 2005 8:46:37 AM

Archived from groups: microsoft.public.win2000.security (More info?)

How can one find out when files were deleted? They have since been
recovered, but it is important to know when (who) deleted them.

Any help is much appreciated

Roger

..

More about : finding files deleted

Anonymous
a b 8 Security
January 21, 2005 8:46:38 AM

Archived from groups: microsoft.public.win2000.security (More info?)

If you were not auditing Delete actions on those files, then
there is no record of when/who. Due to the large volume of
events that could result, auditing of NTFS actions must be
defined according to your needs - there is none in the default.

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
<somebody@compusmart.ab.ca> wrote in message
news:6351v09gprd8tse3d7pv84rirdsbidvnhd@4ax.com...
> How can one find out when files were deleted? They have since been
> recovered, but it is important to know when (who) deleted them.
>
> Any help is much appreciated
>
> Roger
>
> .
January 21, 2005 4:33:38 PM

Archived from groups: microsoft.public.win2000.security (More info?)

"Roger Abell" <mvpNOSpam@asu.edu> wrote:

>If you were not auditing Delete actions on those files, then
>there is no record of when/who. Due to the large volume of
>events that could result, auditing of NTFS actions must be
>defined according to your needs - there is none in the default.

Many thanks for the info. NTFS actions are not audited - we'll never
know who did it.

Roger
!