Like a lot of offices we have a few public shares for different teams to save their data. Today I helped someone restore some folders from a shadow copy that had been deleted sometime last week. While I had the shadow copies (and backups elsewhere), I couldn't answer the obvious first question.
"Who deleted the files?"
We're running Windows 2003 server, everyone has active directory accounts.