How do I trace who deleted a folder?

[CFeyrer]

An important folder has been deleted from our file server by an active directory user. Is there a way I can trace who deleted it and/or restore it?

Thanks.

Christopher Feyrer

 

[JeffG2583]

That's one of the things that stink with deleting things over the network. They don't seem to make it into the recycling bin. If you don't have auditing enabled, it's going to be quite difficult to tell who exactly did it. You could probably use that really expensive recovery software to retrieve it. On-Track Recovery works great. I hope I'm wrong and theres a way for you to recover your folder. Good luck.

 

[CFeyrer]

Where would I look to see if auditing is enabled? Thanks for your quick reply!

 

[technome]

Skip the auditing...

Check out Executive software's "Undelete". Not only can you get back files and revisions deleted on server drives but it tells you who deleted them.
Beat going to tape,... and if Win2003, takes up the slack where "system restore" leaves off. One of the most valuable third party utilities, I never startup a server without it.

http://www.executive.com/undelete/undelete.asp

 

[technome]

Skip the auditing...

Check out Executive software's "Undelete". Not only can you get back files and revisions deleted on server drives but it tells you who deleted them.
Beat going to tape,... and if Win2003, takes up the slack where "system restore" leaves off. One of the most valuable third party utilities, I never startup a server without it.

http://www.executive.com/undelete/undelete.asp