Announcement

Collapse
No announcement yet.

How can I find out who moved files/folders on our file server?

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • How can I find out who moved files/folders on our file server?

    Here's my situation:

    One of the users in our finance department notified me that a bunch of files/folders were missing from sub folder A of the Finance folder. When I did a search for the files/folders that were missing I found them in sub folder B. Is there a way that I can find out who moved them from subfolder A to subfolder B?

    I tried looking in the Event Viewer, but there is so much stuff in there that I'm not sure what Event ID I should look for (if any). Is this even possible or am I out of luck? Any help would be greatly appreciated.

  • #2
    Re: How can I find out who moved files/folders on our file server?

    Do you audit things like that? If not, then you're out of luck. You could try looking at the owner of the files, but that's unlikely to help - most likely it'll either still be the original owner, or it'll have inherited the owner of its new parent folder.
    Gareth Howells

    BSc (Hons), MBCS, MCP, MCDST, ICCE

    Any advice is given in good faith and without warranty.

    Please give reputation points if somebody has helped you.

    "For by now I could have stretched out my hand and struck you and your people with a plague that would have wiped you off the Earth." (Exodus 9:15) - I could kill you with my thumb.

    "Everything that lives and moves will be food for you." (Genesis 9:3) - For every animal you don't eat, I'm going to eat three.

    Comment


    • #3
      Re: How can I find out who moved files/folders on our file server?

      Right, there will be nothing if auditing isn't enabled to audit file operations. Also, the owner as well as any explicit ntfs permission (not inherited) will remain unchanged with the exception of the merging of inherited privileges unless the files were moved from one volume or physical drive to another.
      Last edited by ahinson; 7th January 2009, 02:38.
      Andrew

      ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

      Comment


      • #4
        Re: How can I find out who moved files/folders on our file server?

        No, I don't believe we audit things like that. Is there a way that I could turn that feature on in case it happens again or do I need to have third-party software to do it?

        Comment


        • #5
          Re: How can I find out who moved files/folders on our file server?

          Originally posted by a2thed View Post
          No, I don't believe we audit things like that. Is there a way that I could turn that feature on in case it happens again or do I need to have third-party software to do it?
          This post has some detail about enabling logging for deletes. It's the same for copy/move.
          http://forums.petri.com/showpost.php...4&postcount=15

          In addition to Delete, also audit, Delete Subfolders and Files, Create Files, Create Folders to cover copy and move operations. The only way you'll distinguish between them is the delete that occurs in the move.
          Andrew

          ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

          Comment


          • #6
            Re: How can I find out who moved files/folders on our file server?

            Originally posted by ahinson View Post
            This post has some detail about enabling logging for deletes. It's the same for copy/move.
            http://forums.petri.com/showpost.php...4&postcount=15

            In addition to Delete, also audit, Delete Subfolders and Files, Create Files, Create Folders to cover copy and move operations. The only way you'll distinguish between them is the delete that occurs in the move.
            awesome....thanks!

            Comment

            Working...
            X