Ihave a centos file server mapped in a windows pc. Unfortunately, someone deleted a file inside the file server and UNFORTUNATELY we have just deleted the backup of the file server and it's logs on samba that day due to size is full. Is it possible to track in the windows pc if that pc deleted that file? I wanted to make sure if it's possible to check in the event viewer to see if that specific pc is the culprit. thank you for those who will answer.
Unfortunately the only events logging delete actions don't fit your requirements.
- Both are logged on the system the file is located i.e. server side, and this wasn't even a Windows Server.
- They are not enabled by default as this level of auditing might cause excessive logging.
This event indicates that specific access was requested for an object. The object could be a file system, kernel, or registry object, or a file system object on removable storage or a device.
If access was declined, a Failure event is generated.
This event generates only if the object’s SACL has the required ACE to handle the use of specific access rights.
This event shows that access was requested, and the results of the request, but it doesn’t show that the operation was performed. To see that the operation was performed, check “4663(S): An attempt was made to access an object.”
You need to revise your backup procedures and implement some incremental backup that will keep storing deleted files.