Who deleted the file?

Question

System administration

Greetings. Sobsna the question is simple. There is a server [Server 2003], a local area network and
100 users. All 100 users have access to the server. Files or folders disappear periodically, probably someone deletes (on purpose or not)
Are there similar software for tracking deleted files? (by whom, when, what). Advise

Answer 1

Are there any similar software for tracking deleted files? (by whom, when, what). Advise

And what can you say without knowing the OS?
In windows, you can configure file auditing.
Again, the goal is not clear - do you track down the attacker, or return the desired file to its place?
Most often moved - found and in place.
Sometimes they delete it - for such purposes it is more convenient to use shadow copies.

Answer 2

there are softins and systems for data backup.
everything else is from the evil one.

Answer 3

One hundred thousand millions of different systems, ranging from a banal audit in Windows to sophisticated SMPs. But if there are all one hundred - administrators (and most likely the way it is) - it will be useless

Answer 4

Theoretically - an audit, as mentioned earlier. In practice, it is necessary to sit and constantly clean the audit logs, otherwise there will not be enough disks.
From practice - in 90% of cases the file or directory is not deleted. Just some careless schmuck with an awkward movement of the mouse moved it to some directory. Usually - without even noticing it (it accidentally caught on by itself). Again, from practice - a similar disappearance on Window Server - at least 2-3 times a month, and on the equally intensively used Novell Netware, where such a movement was prohibited resp. file system attribute - 2 or 3 times in more than 10 years.
I strongly recommend looking in the direction of the software, which is collectively called the "Network Recycle Bin". The bottom line is simple - a file deleted over the network is placed in the recycle bin in the same way as if it was deleted in a local session on behalf of a local account. And it's easy to restore, and you can see who deleted it and when. And if there is no file in the basket - these are the same 90%, see above.

Answer 5

If it's not too late: the easiest option is 10-Strike connnection monitor pro
Set up an audit, the program shows who opened / downloaded / watched, who deleted and when, you can temporarily disconnect users from shared folders