Knowing what the user did with a file?

  • Thread starter Thread starter gerteix
  • Start date Start date
G

gerteix

Hello. I want to know how can i audit or know if an user changed,
copied, deleted or created a file.

I am looking for this because i recently had a problem with a notebook
user that stole information from the company. I tried with the audit
policies of Windows XP but it doesn´t give me what i need.

Any idea?

Thanks.
 
gerteix said:
Hello. I want to know how can i audit or know if an user changed,
copied, deleted or created a file.

I am looking for this because i recently had a problem with a notebook
user that stole information from the company. I tried with the audit
policies of Windows XP but it doesn´t give me what i need.

Any idea?

Thanks.
Click to expand...
You would have needed to enable auditing *before* the incident. For
serious issues like yours, you should contact a professional company
which specializes in computer forensics. If the case is not handled
correctly, any information gathered will not hold up in court. I can
recommend DriveSavers, but there may be an expert in your area of the
world. You'll have to look.

http://www.drivesavers.com/services/forensics.html

Malke
 
Back
Top