Warning

 

Close

Confirm Action

Are you sure you wish to do this?

Confirm Cancel
Member Login
Site Notices
Posted: 2/8/2006 9:05:57 AM EDT
Isn't there a way to look back and see what kind of activity has taken place recently?Specifically if any files have been deleted? I believe I've done it before, but I can't remember how to do it.

On one of my systems here at work, some software is not working properly anymore, like some critical files have been deleted. It was OK Friday and then for some reason Moday morning it was fucked up. There is a guy that has access to it at night and I need to see what if anything was deleted between the time I left Friday to Monday morning.

Link Posted: 2/8/2006 11:37:50 AM EDT
Depends on how stupid the person doing the deleting is. Check the recycle bin. If they didn't empty it, all the files are there. You can restore them individually.
If they cleared it, then you need other software to bring back the deleted files.
If you just want to see what was accessed, check documents in the start bar menu.
Link Posted: 2/8/2006 11:40:48 AM EDT
Why does this guy have an ADMIN account to install/uninstall software?

Each person should have a separate login and only a guest/other account that doesn't allow them to remove applications.
Link Posted: 2/8/2006 11:55:14 AM EDT
Enable auditing, then set the appropriate audit entries on each file/folder.
Link Posted: 2/8/2006 12:03:35 PM EDT
[Last Edit: 2/8/2006 12:03:51 PM EDT by motocam25]

Originally Posted By 89grand:
Isn't there a way to look back and see what kind of activity has taken place recently?Specifically if any files have been deleted? I believe I've done it before, but I can't remember how to do it.

On one of my systems here at work, some software is not working properly anymore, like some critical files have been deleted. It was OK Friday and then for some reason Moday morning it was fucked up. There is a guy that has access to it at night and I need to see what if anything was deleted between the time I left Friday to Monday morning.




Sounds fishy, you are trying to incriminate someone at home? j/k
Link Posted: 2/8/2006 12:07:20 PM EDT
Use the Event Viewer under the Administrative Tools in the Start Menu. It will tell you who logged on and when. It can also tell you when certain things take place, but you need to set it up to be flagged ahead of time.
Top Top