Report on deleted files

[candaced]

I would like to get a report of ALL files in ALL directories on a volume that were deleted by a specific user, and maybe on a specific day.

Is such a thing possible?

[aburgemeister]

I'm not sure otherwise (check Salvage if this is NSS) but if you have the
Vigil-based auditing enabled, usually to point to something like NetIQ
Sentinel, then this should definitely be possible as it will report on
creates, deletes, modifies, etc. with the usernames from eDirectory on
NSS/NCP/CIFS (as I recall) connections. It can also show ACL changes and
the like. If you do not have auditing setup at the time of the operation
you want to capture, then of course the system isn't going to store all of
those details perpetually somewhere as it would consume tons of space
needlessly.

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.

[Anonymous_User]

Hi

Probably JRBTools may help:
http://www.jrbsoftware.com/jrbutils_nw/utils/s/#Salvlist

regards
Markus