Like a lot of offices we have a few public shares for different teams to save their data. Today I helped someone restore some folders from a shadow copy that had been deleted sometime last week. While I had the shadow copies (and backups elsewhere), I couldn't answer the obvious first question.

"Who deleted the files?"

We're running Windows 2003 server, everyone has active directory accounts.


Do you have object access auditing enabled and did you have auditing configured for the files\folders that were deleted? If the answers are no, then you won't be able to find out who deleted the content in question.

| improve this answer | |
  • @wizard, See here for details about auditing serverfault.com/questions/125310/… – Zoredache May 11 '10 at 17:00
  • I had the same problem and it turns out a user accidentically dragged the missing folder into a nearby folder within the share. Its worth checking out to avoid duplication or someone working/saving to an incorrect directory unknowningly. – iainlbc May 11 '10 at 17:05
  • 1
    Tell the users that they have 24 hours to admit it until you higher the expensive forensics specialists. – Kyle Brandt May 11 '10 at 18:33
  • @kyle I don't believe that most of them would know if they did it. – reconbot May 13 '10 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.