Notifications

Clear all

Forensic who deleted files in fileserver without Auditing

AngeloNathaniel · 2016-12-11T12:54:44Z

Hi Guys,Please help me, we have the network shares/file server and we have an incident which someone deleted the files/folder in our network shares which badly the windows audit policy is not working. Is there any forensic tools or way to find the culprit who deleted the said files/folder.Thank you and more power..

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by Thomas 8 years ago

13 Posts

5 Users

0 Reactions

3,304 Views

RSS

passcodeunlock

(@passcodeunlock)

Prominent Member

Joined: 9 years ago

Posts: 792

13/12/2016 3:10 pm

Narrow down your targets to the used workstations and logged in users, and search for artifacts on both server and workstation side.

ReplyQuote

nightworker

(@nightworker)

Estimable Member

Joined: 16 years ago

Posts: 134

13/12/2016 3:53 pm

Add your servers physical drive yo your case

open recyclebin folder

and take windows sid of who deleted specific file

ReplyQuote

Thomas

(@thomas)

Trusted Member

Joined: 19 years ago

Posts: 59

26/02/2017 9:23 pm

Just wondering if you find the perpetrator and if so…. how?

ReplyQuote

Page 2 / 2 Prev

8 Forums
15.7 K Topics
92.3 K Posts
270 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed