Auditing file access

[ChampagneLSC]

I had an issue come up where management wants to know who modified a file. I am now auditing file access on the server, but I do not know if of a way to go back and see who modified a file before the auditing was implemented.

Does NTFS store any attributes by default that I could use to find this information?

Any help would be greatly appreciated.

Thanks in advance

 

[tim28375]

Unfortunatly not if auditing was not enabled for file access you will not be able to tell who has changed the files, you will be able to tell when it was last modified but no who did it.

this only tell you when it was last modified it does not provide any history.

There may be other ways of gathering this info using 3rd party but i am unaware of any.

Hope this helps.

Tim
MCSE 2003
HP APS

 

[ChampagneLSC]

That's what I was thinking. I don't know of any 3rd party utility ot do so either.

Thanks