Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Like a lot of offices we have a few public shares for different teams to save their data. Today I helped someone restore some folders from a shadow copy that had been deleted sometime last week. While I had the shadow copies (and backups elsewhere), I couldn't answer the obvious first question.

"Who deleted the files?"

We're running Windows 2003 server, everyone has active directory accounts.

share|improve this question
I also found this link to be useful, it talks about adding auditing entries on folders.… – reconbot May 11 '10 at 18:07
up vote 8 down vote accepted

Do you have object access auditing enabled and did you have auditing configured for the files\folders that were deleted? If the answers are no, then you won't be able to find out who deleted the content in question.

share|improve this answer
@wizard, See here for details about auditing… – Zoredache May 11 '10 at 17:00
I had the same problem and it turns out a user accidentically dragged the missing folder into a nearby folder within the share. Its worth checking out to avoid duplication or someone working/saving to an incorrect directory unknowningly. – iainlbc May 11 '10 at 17:05
Tell the users that they have 24 hours to admit it until you higher the expensive forensics specialists. – Kyle Brandt May 11 '10 at 18:33
@kyle I don't believe that most of them would know if they did it. – reconbot May 13 '10 at 15:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.