{"id":220,"date":"2016-05-10T22:40:07","date_gmt":"2016-05-10T22:40:07","guid":{"rendered":"http:\/\/eventlogxp.com\/blog\/?p=220"},"modified":"2016-12-09T16:10:45","modified_gmt":"2016-12-09T16:10:45","slug":"tracking-down-who-removed-files","status":"publish","type":"post","link":"https:\/\/eventlogxp.com\/blog\/tracking-down-who-removed-files\/","title":{"rendered":"Tracking down who removed files"},"content":{"rendered":"

Let’s assume you have a shared folder on a server which is accessible by all employees in your company. The users commonly copy some documents into this folder to let the others to work with these shared documents. One day you discover that some files unexpectedly disappeared from the shared folder. Usually\u00a0this means that someone deleted these files (consciously or unconsciously). Now we need to detect the person who removed the files.<\/p>\n

First, you need to setup Windows security auditing to monitor file access (and optionally logon) events. Of course, you should do it right after creating a shared folder and granting access to it (post factum setup won’t help you) . This\u00a0article<\/a> describes how to setup security auditing and audit file access and logon events.<\/p>\n

If you correctly setup file access auditing for your shared folder, “File system” events will appear in Security log on every attempt to open file inside the folder.<\/p>\n

\"file<\/a><\/p>\n

So be sure that the maximum log size for Security log is set to a reasonable value (or you have a chance to lose old events). Microsoft recommends 4GB for most of Windows, but this depends on different factors \u2013 I prefer much smaller sizes with autobackup option.<\/p>\n

Event 4660 occurs when someone removes a file or a folder. But its event description doesn’t contain the file name:<\/p>\n

An object was deleted.\r\n\r\nSubject:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Security ID:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 S-1-5-21-3946697505-1589476648-2597793080-1114\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Account Name:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0     mike\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Account Domain:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0FSPRO\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Logon ID:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0084C195\r\n\r\nObject:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Object Server:\u00a0\u00a0 Security\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Handle ID:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 00000AC8\r\n\r\nProcess Information:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Process ID:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 00000004\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Process Name:\u00a0\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Transaction ID: {00000000-0000-0000-0000-000000000000}<\/pre>\n
In fact, when a user deletes file, Windows registers several events: 4663 and then 4660. It can also register event 4656 before 4663).<\/p>\n
Here is a sample of 4663 event description:<\/p>\n
An attempt was made to access an object.\r\n\r\nSubject:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Security ID:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 S-1-5-21-3946697505-1589476648-2597793080-1114\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Account Name:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0     mike\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Account Domain:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0FSPRO\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Logon ID:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0084C195\r\n\r\nObject:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Object Server:\u00a0\u00a0 Security\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Object Type:\u00a0\u00a0\u00a0\u00a0 File\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Object Name:\u00a0\u00a0\u00a0  C:\\shared\\Data\\_DSC9978.JPG\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Handle ID:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a000000AC8\r\n\r\nProcess Information:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Process ID:\u00a0\u00a0\u00a0\u00a0\u00a0 00000004\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Process Name:\u00a0\r\n\r\nAccess Request Information:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Accesses:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 DELETE\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Access Mask:\u00a0\u00a0\u00a0  10000\r\n\r\n<\/pre>\n
You can notice that “Access Request Information” group contains Accesses: DELETE and Access Mask: 10000 parameters.<\/p>\n
So we can just filter security event log by Event ID = 4663 and Access Request Information\\Accesses = DELETE (and if you enabled auditing for several folders, but want to check a specific one, you should also add filter by Object\\Object Name):<\/p>\n
\"event<\/a><\/p>\n
Now we can see all “file delete” events with file names.<\/p>\n
This method works most of time, but I wouldn’t call it perfect. First, nobody guaranty that Accesses will be DELETE all the time (although you can try Access Request Information\\Accesses Contains DELETE). Second, 4663 event occurs on access attempt. In some cases, e.g. if your file is protected, event 4660 won’t appear. So to get more accurate picture, we should rely upon 4663 events and get details from the previous events. Event Log Explorer features Linked Filter, which allows you to link events in security log by description parameter. Look again at 4660 and 4663 event samples. You can link them by Object\\Handle ID parameter. Note that Linked Filter scans events from top to bottom, so make sure that you sorted events from new to old (our base event will be 4660).<\/p>\n
\"linked<\/a><\/p>\n
Here I got the same result as before.<\/p>\n
Now you can just display who deleted files. Event description keeps these details in “subject” group. I will use custom columns to show these details in the list:<\/p>\n
\"custom<\/a><\/p>\n
Here is the result of adding custom columns:<\/p>\n
\"showing-users<\/a><\/p>\n
You probably noticed that I added Logon ID along with User name. Using the Logon ID, we can detect from which machine user FSPRO\\mike deleted files.<\/p>\n
Just set a new filter for event id = 4624 (An account was successfully logged on):<\/p>\n
\"looking<\/a><\/p>\n
And we are getting the machine name and its IP address<\/p>\n
\"workstation<\/a><\/p>\n
 <\/p>\n\"Facebook\"<\/a>\"twitter\"<\/a>\"reddit\"<\/a>\"pinterest\"<\/a>\"linkedin\"<\/a>\"mail\"<\/a>","protected":false},"excerpt":{"rendered":"
Let’s assume you have a shared folder on a server which is accessible by all employees in your company. The users commonly copy some documents into this folder to let the others to work with these shared documents. One day you discover that some files unexpectedly disappeared from the shared folder. Usually\u00a0this means that someone deleted these files (consciously or unconsciously). Now we need to\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":2,"featured_media":232,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[42],"tags":[5,51,21,49,4,15],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/220"}],"collection":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/comments?post=220"}],"version-history":[{"count":7,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/220\/revisions"}],"predecessor-version":[{"id":234,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/220\/revisions\/234"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/media\/232"}],"wp:attachment":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/media?parent=220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/categories?post=220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/tags?post=220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}