Finding out when files were deleted.

  • Thread starter Thread starter somebody
  • Start date Start date
S

somebody

How can one find out when files were deleted? They have since been
recovered, but it is important to know when (who) deleted them.

Any help is much appreciated

Roger

..
 
If you were not auditing Delete actions on those files, then
there is no record of when/who. Due to the large volume of
events that could result, auditing of NTFS actions must be
defined according to your needs - there is none in the default.
 
Roger Abell said:
If you were not auditing Delete actions on those files, then
there is no record of when/who. Due to the large volume of
events that could result, auditing of NTFS actions must be
defined according to your needs - there is none in the default.
Click to expand...

Many thanks for the info. NTFS actions are not audited - we'll never
know who did it.

Roger
 
Back
Top