Knowing what the user did with a file?

Hello. I want to know how can i audit or know if an user changed,
copied, deleted or created a file.

I am looking for this because i recently had a problem with a notebook
user that stole information from the company. I tried with the audit
policies of Windows XP but it doesn´t give me what i need.

Any idea?

Thanks.


--
gerteix

gerteix wrote:

>
> Hello. I want to know how can i audit or know if an user changed,
> copied, deleted or created a file.
>
> I am looking for this because i recently had a problem with a notebook
> user that stole information from the company. I tried with the audit
> policies of Windows XP but it doesn´t give me what i need.
>
> Any idea?
>
> Thanks.
>
>
You would have needed to enable auditing *before* the incident. For
serious issues like yours, you should contact a professional company
which specializes in computer forensics. If the case is not handled
correctly, any information gathered will not hold up in court. I can
recommend DriveSavers, but there may be an expert in your area of the
world. You'll have to look.

http://www.drivesavers.com/services/forensics.html

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User