IT Employment

Ask something
Discussion Locked

deleted file history for file share

0 helpful
2 replies

by erik.barbee

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
We suspect a malicous employee may have deleted some files from a network share, but we do not have proof. Is there a quick way to determine if files have been deleted? I can compare the backup logs to the present file share, but I was hoping for quicker way. Any ideas?

2 replies

by timwalsh

It is safe to assume that at present you just want to determine if the file was deleted (vs. moved to a different location) - rather than determining if the user in qhestion did the deleting?

The quickest way (assuming you know the titles of the files) would be to run a search for the files on your entire directory tree. However, all this will prove is the existance or absence of the files on the share. If the files are absent, you can't determin if the files were deleted, or just moved elswhere (a move operation actually combines a copy operation with a delete operation).

Unless auditing was enabled for the files in question, you probably can't determine if the files are gone for good or just hidden someplace (moved elsewhere).

by leroy_93

As opposed to comparing the backup log to the current directory, you can just compare the total size and number of files. That should give you enough info to decide if you want to do a file by file comparison

This discussion is closed to new replies.