Computer Event related #5
-
|
My question is that if someone else deletes a file from my PC then how will I find it , that is it's exact timestamp? |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
Open the Event Viewer and search the security log for event ID 4656 with a task category of "File System" or "Removable Storage" and the string "Accesses: DELETE". Review the report. The "Subject: Security ID" field will show who deleted each file. |
Beta Was this translation helpful? Give feedback.
-
|
you can also create custom filters in event viewer for the same and it will auto filter the events based on event ID |
Beta Was this translation helpful? Give feedback.
Open the Event Viewer and search the security log for event ID 4656 with a task category of "File System" or "Removable Storage" and the string "Accesses: DELETE". Review the report. The "Subject: Security ID" field will show who deleted each file.