Archived from groups: microsoft.public.win2000.security (More info?
If you were not auditing Delete actions on those files, then
there is no record of when/who. Due to the large volume of
events that could result, auditing of NTFS actions must be
defined according to your needs - there is none in the default.
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
<email@example.com> wrote in message
> How can one find out when files were deleted? They have since been
> recovered, but it is important to know when (who) deleted them.
> Any help is much appreciated