Varonis announces strategic partnership with Microsoft to accelerate the secure adoption of Copilot.

Learn more

Someone Deleted My File. How Can I Find Out Who?

If you’ve ever been tasked with recovering a lost file or folder and had to explain exactly what happened (Who moved or deleted it? When did it happen? Why?), you...
Michael Buckbee
1 min read
Published February 11, 2015
Last updated June 9, 2023

If you’ve ever been tasked with recovering a lost file or folder and had to explain exactly what happened (Who moved or deleted it? When did it happen? Why?), you know how annoyingly time-consuming it can be. And sometimes you simply don’t have any good answers. All you can do is restore from backup.

How do we fix this?

Having an audit trail can help tremendously, but native auditing on Windows, UNIX, and many other platforms is resource intensive, provides too much data, eats up storage, and slows servers down. It’s easy to see why auditing is rarely enabled.

Performing Forensic Investigations the Hard Way

Let’s see what it really takes to perform forensic investigations on Windows using native auditing.

Windows auditing for file access first requires that successful object access attempts be enabled, via the local or domain security policy settings.

default domain security settings

Next, each folder’s auditing settings must be modified to include the users you wish to audit. The image below shows that “everyone” who accesses the finance folder will be audited.

finance

Once auditing is enabled, events will show up in the security event container:

Event Viewer

Get the Free PowerShell and Active Directory Essentials Video Course

The events must be opened up individually to inspect their contents.

4

There are some filtering abilities if you know which user you’re interested in, but not for directory name, file type, delete events. So, what can we do next?

5

Give Varonis’ DatAdvantage a try if you’re on the help desk, doing forensics for security, and auditing data use – you’ll be able to quickly answer these frequently asked questions:

  • Who has been accessing this folder?
  • What data has this user been accessing?
  • Who sent emails to whom?
  • Who deleted these files?
  • Where did those files go?

audit

To learn more: download our Whitepaper – Accelerating Audits with Automation

What you should do now

Below are three ways we can help you begin your journey to reducing data risk at your company:

  1. Schedule a demo session with us, where we can show you around, answer your questions, and help you see if Varonis is right for you.
  2. Download our free report and learn the risks associated with SaaS data exposure.
  3. Share this blog post with someone you know who'd enjoy reading it. Share it with them via email, LinkedIn, Reddit, or Facebook.

Try Varonis free.

Get a detailed data risk report based on your company’s data.
Deploys in minutes.

Keep reading

Varonis tackles hundreds of use cases, making it the ultimate platform to stop data breaches and ensure compliance.

securityrwd---microsoft-365-makes-collaboration-easy-–-almost-too-easy
SecurityRWD - Microsoft 365 Makes Collaboration Easy – Almost Too Easy
Kilian Englert and Ryan O'Boyle from the Varonis Cloud Architecture team examine different types of sharing in Microsoft 365, and what really happens behind the scenes.
covid-19-threat-update-#6
COVID-19 Threat Update #6
Hoarding isn’t just happening with toilet paper: we’re seeing cases where remote employees have downloaded department-level folders. Chances are, these files will contain sensitive data like PII, PCI, HIPAA and...
fighting-golden-ticket-attacks-with-privileged-attribute-certificate-(pac)
Fighting Golden Ticket Attacks with Privileged Attribute Certificate (PAC)
Learn how and why to control the Active Directory Environment state with PACRequestorEnforcement, the implications of doing so and how to detect Golden Ticket attacks happening in your network.
threat-update-34-–-isn't-the-internet-supposed-to-be-bombproof?
Threat Update 34 – Isn't the Internet Supposed to be Bombproof?
Kilian & Ryan dissect what could happen if a major data center went down, and how organizations leveraging cloud technology or solutions can prepare for business continuity.