Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

CHECKING THE SYSTEM HISTORY

Feb 28, 2004 12:07PM PST

I need to check if someone deletes any file from a computer. I?m going to see the computer on wednesday and I need to check if someone deleted files today. Any way to enter the system and check that?

Discussion is locked

- Collapse -
Re:CHECKING THE SYSTEM HISTORY
Feb 28, 2004 8:08PM PST

You can try looking in the recycle bin, if the files are still there.

- Collapse -
Have Mr. Burns watch it.
Feb 28, 2004 10:12PM PST
http://ourworld.compuserve.com/homepages/esmsoftware/mrburns.htm

In the case of NT, Windows 2000, XP and such capable OSes, the AUDITING features can be enabled and you can check the event viewer to see what was deleted by which logon.

It doesn't actually reveal WHO did it since there is no witness to tell if the CAT walked over the keyboard or played with the mouse.

Bob
- Collapse -
Re:Have Mr. Burns watch it.
Feb 29, 2004 8:31AM PST

Thanks BOB, I?ll install Mr. Burns on Wednesday, but... I won?t have the computer on my hands until Wednesday and I need to check if someone deleted files yesterday, or today. Any way to do it?

- Collapse -
Re:Re:Have Mr. Burns watch it.
Feb 29, 2004 8:47AM PST

"I need to check if someone deleted files yesterday, or today. Any way to do it?"

This sounds simple. If the files are not on the drive, then someone deleted them!

Bob