Ihave a centos file server mapped in a windows pc. Unfortunately, someone deleted a file inside the file server and UNFORTUNATELY we have just deleted the backup of the file server and it's logs on samba that day due to size is full. Is it possible to track in the windows pc if that pc deleted that file? I wanted to make sure if it's possible to check in the event viewer to see if that specific pc is the culprit. thank you for those who will answer.

1 Answer 1


Unfortunately the only events logging delete actions don't fit your requirements.

  1. Both are logged on the system the file is located i.e. server side, and this wasn't even a Windows Server.
  2. They are not enabled by default as this level of auditing might cause excessive logging.

4656(S, F): A handle to an object was requested.

This event indicates that specific access was requested for an object. The object could be a file system, kernel, or registry object, or a file system object on removable storage or a device.

If access was declined, a Failure event is generated.

This event generates only if the object’s SACL has the required ACE to handle the use of specific access rights.

This event shows that access was requested, and the results of the request, but it doesn’t show that the operation was performed. To see that the operation was performed, check “4663(S): An attempt was made to access an object.”

You need to revise your backup procedures and implement some incremental backup that will keep storing deleted files.

  • thank you for this information and yes we also have backuop procedure that will keep storing deleted file, unfortunately it was included on the clearing of files that day. Bad day for me. Feb 22, 2019 at 0:14
  • Additional but very painful ways to track this would be to sniff and log network traffic (SMB should be readable down to command level?) as well as running Microsoft's sysinternals tools on the workstation. Both methods would produce insane amounts of data though. The linux side must have some auditing tools too - though even then it may only make sense to monitor a specific file and the deletion event might not log the external SMB client by name.
    – HackneyB
    Feb 23, 2019 at 22:57
  • These kind of tools will only work for investigating live scenarios. This question is about investigating files already removed. Feb 24, 2019 at 2:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.