CAN DELETION OF FILE BE TRACED?

[Faraz A. Qureshi]

I am working in an office with local server in addition to our personal
drives for different files being shared. I have recently found some of my
files being deleted. Is it possible to detect who might have done so, amongst
the users/IPs?

--
Best Regards,

Faraz

[John John - MVP]

You won't be able to find much of anything after the fact, you need to
enable auditing of file and folders if you want to keep track of these
kind of events.

John

Faraz A. Qureshi wrote:
> I am working in an office with local server in addition to our personal
> drives for different files being shared. I have recently found some of my
> files being deleted. Is it possible to detect who might have done so, amongst
> the users/IPs?
>

[Faraz A. Qureshi]

How to enable such a feature of auditing?
--
Best Regards,

Faraz


"John John - MVP" wrote:

> You won't be able to find much of anything after the fact, you need to
> enable auditing of file and folders if you want to keep track of these
> kind of events.
>
> John
>
> Faraz A. Qureshi wrote:
> > I am working in an office with local server in addition to our personal
> > drives for different files being shared. I have recently found some of my
> > files being deleted. Is it possible to detect who might have done so, amongst
> > the users/IPs?
> >
>

[Malke[_2_]]

Faraz A. Qureshi wrote:

> How to enable such a feature of auditing?

Audit User Access of Files, Folders, and Printers in Windows XP -
http://support.microsoft.com/Default.aspx?kbid=310399

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!
http://www.elephantboycomputers.com/#FAQ

[John John - MVP]

Search for "auditing" in your help files. The may be helpful:

http://articles.techrepublic.com.com/5100-10878_11-5034308.html
Step-By-Step: How to audit file and folder access to improve Windows
2000 Pro security (Practically the same thing for Windows XP)

http://support.microsoft.com/kb/310399
How to audit user access of files, folders, and printers in Windows XP

http://search.yahoo.com/search;_ylt=A0geu5Bn8cFKgx8ApmpXNyoA?p=auditing+of +file+and+folders++site%3Amicrosoft.com&fr2=sb-top&fr=yfp-t-501&sao=0

Make sure that your Security Log (in the Event Viewer) is set to
"Overwrite events as needed".

John

Faraz A. Qureshi wrote:
> How to enable such a feature of auditing?

[John John - MVP]

PS. If you want to track/audit events over many days make sure that the
size of the Security Log is adequate. Go easy on auditing, don't go
overboard trying to audit all kinds of events and actions. Auditing
objects has a certain amount of overhead and it can quickly fill up the
log, if the Security Log fills up, and if it isn't set to overwrite as
necessary, you won't be able to logon to the machine.

John

John John - MVP wrote:

> Make sure that your Security Log (in the Event Viewer) is set to
> "Overwrite events as needed".
>
> John
>
> Faraz A. Qureshi wrote:
>> How to enable such a feature of auditing?

[db[_3_]]

if people are opening those files
at the same time,

then they likely crashed and the
files became unusable and un-indexed.

the files need to be configured for
multi users,

which would allow the first person
to open, read and write the file.

and open as read only for other
users while it is in use by the above.

in any case, it is hoped you have a
copy of those files stored locally.


--
db·´¯`·...¸><)))º>
DatabaseBen, Retired Professional
- Systems Analyst
- Database Developer
- Accountancy
- Veteran of the Armed Forces
- @Hotmail.com
- nntp Postologist
~ "share the nirvana" - dbZen

~~~~~~~~~~~~~~~
>
>

"Faraz A. Qureshi" > wrote in
message ...
> I am working in an office with local server in addition to our personal
> drives for different files being shared. I have recently found some of my
> files being deleted. Is it possible to detect who might have done so,
> amongst
> the users/IPs?
>
> --
> Best Regards,
>
> Faraz