I just read an interesting forum post of a guy worrying his company were trying to get rid of him by messing with files and deleting his work.
i am really curious how this person should proceed? Obviously a forensic investigation could liekly proove this, but how does the employee go about this? Wait untill hes sacked and try and go through the courts?
Short of making sure he keeps track of his use of the computer what else could he do to protect himself?
If they're being deleted off his own machine then image the machine (recording all events and commands used) in a point and time, save to secure media (encrypted external HDD) and place somewhere secure.
At least if anything comes of it there is a forensic image that can be verified and used by both parties to argue over.
Albeit this is a bit extreme it might be better to use common sense and talk to management about his concerns and discuss the options.