That is what displays under the owner tab of a file that we have under the heading “Current owner of this item:”. Here’s the problem I need to find out who that owner is. Taking ownership of course replaces this value in the file properties. This is on a Windows Server 2000 partition and does not have auditing enabled for the files in question. Without going into a lengthy explanation for why we need to have the current owner/author suffice it to say that it is an apparent security violation and this appears to be the only forensic evidence that we might be able to gather against the suspect. In summary we have files that have deny permissions for everyone except a particular user, without overwriting the owner attribute and effectively deleting the evidence that we have, we need a way to view the owner/author attribute of the files or any other clever way of determining who created the files in question (bear in mind that the files are already extant). Thanks.
