How can you know the person who delete major files in Win2k server or win2k03 ?

[zener]

Is there a way to trace back the culprit who deleted about 8gb of data in a win2k server system? Thanks,

 

[stash]

Auditing. If it wasn't enabled when the deletion occurred, you're out of luck.

 

[NogginBoink]

what he said.

 

[Nothinman]

If it was on NetWare you could just use the file salvaging tools =)

 

[stash]

Or the volume shadow copy service on 2003.

 

[Nothinman]

Does volume shadow tell you who deleted the file as well? Serious question, I'm not on the NT team at work so I've never had a reason to play with Win2K3.

 

[stash]

Good question. I'm not sure, but I would guess no, unless auditing was enabled.

 

[Smilin]

Correct, shadow copy simply helps you retrieve lost files it doesn't tell you how they were lost. Auditing does that.