Finding out when files were deleted.

[somebody]

How can one find out when files were deleted? They have since been
recovered, but it is important to know when (who) deleted them.

Any help is much appreciated

Roger

..

 

[Roger Abell]

If you were not auditing Delete actions on those files, then
there is no record of when/who. Due to the large volume of
events that could result, auditing of NTFS actions must be
defined according to your needs - there is none in the default.

 

[somebody]

If you were not auditing Delete actions on those files, then
there is no record of when/who. Due to the large volume of
events that could result, auditing of NTFS actions must be
defined according to your needs - there is none in the default.

Many thanks for the info. NTFS actions are not audited - we'll never
know who did it.

Roger