Ok here goes, our NT Manager/ administratior quit 2 weeks ago and has not been replaced. Last night someone deleted all the contents of a folder and everyone is looking at me to solve the problem and answer the question of who deleted that! The problem, with our back up scheme we can only restore the entire drive losing all info stored in the other folders, thats not a problem I can work around that. We use a Winnt 4 with sp5 server, I checked and there was no auditing on the server, thats changed, how do I find out who deleted the contents of the folder when the auditing was turned off. There is nothing in the event viewer logs and I didn’t see anything in the system log. I’m at a loss here can anyone provide an answer?
