{"id":252,"date":"2019-01-08T01:38:11","date_gmt":"2019-01-08T01:38:11","guid":{"rendered":"https:\/\/zineausa.com\/blog\/?p=252"},"modified":"2019-01-08T01:47:50","modified_gmt":"2019-01-08T01:47:50","slug":"tracking-file-deletions-on-windows","status":"publish","type":"post","link":"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/","title":{"rendered":"Tracking File Deletions on Windows"},"content":{"rendered":"\n<p>If  you are suspecting a user, process, virus, malware, or hacker deleting your files, you don&#8217;t have to buy expensive software to track what is deleting files. You can keep track of anything that deleted your files using Windows auditing. You need to have Windows Professional or better (Home will not work) to use this solution, though.<\/p>\n\n\n\n<p>The guide below is made for Windows 10 but should be very similar to follow in Windows 7. Windows servers are also a bit different where you have to enable the audit object access settings via GPO.<\/p>\n\n\n\n<p>First off, we need to enable auditing for object access. To do this, open up your administrative tools, by searching it after pressing your windows button, or going here:<\/p>\n\n\n\n<p class=\"code\">Control Panel\\System and Security\\Administrative Tools<\/p>\n\n\n\n<p>Double click on the local security policy icon.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"752\" height=\"268\" src=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img1.png\" alt=\"\" class=\"wp-image-253\" srcset=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img1.png 752w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img1-600x214.png 600w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img1-300x107.png 300w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img1-750x268.png 750w\" sizes=\"auto, (max-width: 752px) 100vw, 752px\" \/><\/figure>\n\n\n\n<p>Now, go into Security Settings -&gt; Local Policies -&gt; Audit Policy and double click on Audit Object Access, check both success and failure and press save.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"897\" height=\"564\" src=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img2.png\" alt=\"\" class=\"wp-image-254\" srcset=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img2.png 897w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img2-600x377.png 600w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img2-300x189.png 300w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img2-768x483.png 768w\" sizes=\"auto, (max-width: 897px) 100vw, 897px\" \/><\/figure>\n\n\n\n<p>Alright, step one is done. Now, go to the folder or file you want to monitor (Desktop in our example below), and right click and press properties, then go to the security tab and press &#8220;Advanced&#8221;<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"355\" height=\"478\" src=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img3.png\" alt=\"\" class=\"wp-image-255\" srcset=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img3.png 355w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img3-223x300.png 223w\" sizes=\"auto, (max-width: 355px) 100vw, 355px\" \/><\/figure>\n\n\n\n<p>Now, go to the auditing tab and press &#8220;Advanced&#8221;<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"685\" height=\"265\" src=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img4.png\" alt=\"\" class=\"wp-image-256\" srcset=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img4.png 685w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img4-600x232.png 600w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/img4-300x116.png 300w\" sizes=\"auto, (max-width: 685px) 100vw, 685px\" \/><\/figure>\n\n\n\n<p>Press &#8220;Add&#8221;, then click on &#8220;Select a Principal&#8221;, then type &#8220;Everyone&#8221; (you can optionally press check names here if you&#8217;d like), then press OK. You can also choose to monitor specific users here if you&#8217;d like by typing in their usernames.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"891\" height=\"508\" src=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-10.png\" alt=\"\" class=\"wp-image-270\" srcset=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-10.png 891w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-10-600x342.png 600w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-10-300x171.png 300w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-10-768x438.png 768w\" sizes=\"auto, (max-width: 891px) 100vw, 891px\" \/><\/figure>\n\n\n\n<p>Now, press &#8220;Show advanced permissions&#8221;<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"891\" height=\"244\" src=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-1.png\" alt=\"\" class=\"wp-image-258\" srcset=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-1.png 891w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-1-600x164.png 600w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-1-300x82.png 300w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-1-768x210.png 768w\" sizes=\"auto, (max-width: 891px) 100vw, 891px\" \/><figcaption><br><\/figcaption><\/figure>\n\n\n\n<p>Check only the &#8220;Delete subfolders and files&#8221; and &#8220;delete&#8221; options, and press Ok.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"895\" height=\"402\" src=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-2.png\" alt=\"\" class=\"wp-image-259\" srcset=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-2.png 895w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-2-600x269.png 600w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-2-300x135.png 300w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-2-768x345.png 768w\" sizes=\"auto, (max-width: 895px) 100vw, 895px\" \/><\/figure>\n\n\n\n<p>Press OK again and it should populate the settings for everything in the folder you selected.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"759\" height=\"515\" src=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-3.png\" alt=\"\" class=\"wp-image-262\" srcset=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-3.png 759w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-3-600x407.png 600w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-3-300x204.png 300w\" sizes=\"auto, (max-width: 759px) 100vw, 759px\" \/><\/figure>\n\n\n\n<p>Now go into your folder and make a test file (E.g. &#8220;deletetest.txt&#8221;), then delete it. Type in &#8220;Event&#8221; in your search bar and open your event viewer.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"385\" height=\"247\" src=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-5.png\" alt=\"\" class=\"wp-image-264\" srcset=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-5.png 385w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-5-300x192.png 300w\" sizes=\"auto, (max-width: 385px) 100vw, 385px\" \/><\/figure>\n\n\n\n<p>Now, press &#8220;Create Custom View&#8221;, then select &#8220;By source&#8221; under the filter tab, then scroll down and select &#8220;Microsoft Windows Security Auditing.&#8221; In the task category field select &#8220;File System,&#8221; and then for keywords select &#8220;Audit Failure&#8221; and &#8220;Audit Success&#8221;, then press OK.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"964\" height=\"537\" src=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-6.png\" alt=\"\" class=\"wp-image-265\" srcset=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-6.png 964w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-6-600x334.png 600w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-6-300x167.png 300w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-6-768x428.png 768w\" sizes=\"auto, (max-width: 964px) 100vw, 964px\" \/><\/figure>\n\n\n\n<p>Give it a name like &#8220;Deleted files filter&#8221;<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"393\" height=\"336\" src=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-7.png\" alt=\"\" class=\"wp-image-266\" srcset=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-7.png 393w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-7-300x256.png 300w\" sizes=\"auto, (max-width: 393px) 100vw, 393px\" \/><\/figure>\n\n\n\n<p>Alright, now right click your new filter and press on &#8220;find&#8221;, then search the name of the file that was deleted:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"365\" height=\"383\" src=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-8.png\" alt=\"\" class=\"wp-image-267\" srcset=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-8.png 365w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-8-286x300.png 286w\" sizes=\"auto, (max-width: 365px) 100vw, 365px\" \/><\/figure>\n\n\n\n<p>Now, you should see an event log related to who or what deleted your file!<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"722\" height=\"738\" src=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-9.png\" alt=\"\" class=\"wp-image-268\" srcset=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-9.png 722w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-9-600x613.png 600w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-9-293x300.png 293w, https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/image-9-60x60.png 60w\" sizes=\"auto, (max-width: 722px) 100vw, 722px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>If you are suspecting a user, process, virus, malware, or hacker deleting your files, you don&#8217;t have to buy expensive software to track what is deleting files. You can keep track of anything that deleted your files using Windows auditing. You need to have Windows Professional or better (Home will not work) to use this [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":272,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-252","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-how-to"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Tracking File Deletions on Windows - Zinea InfoSec Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Tracking File Deletions on Windows - Zinea InfoSec Blog\" \/>\n<meta property=\"og:description\" content=\"If you are suspecting a user, process, virus, malware, or hacker deleting your files, you don&#8217;t have to buy expensive software to track what is deleting files. You can keep track of anything that deleted your files using Windows auditing. You need to have Windows Professional or better (Home will not work) to use this [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/\" \/>\n<meta property=\"og:site_name\" content=\"Zinea InfoSec Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/zineausa\/\" \/>\n<meta property=\"article:published_time\" content=\"2019-01-08T01:38:11+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-01-08T01:47:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/nodelete.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1322\" \/>\n\t<meta property=\"og:image:height\" content=\"1019\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Zinea\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ZineaLLC\" \/>\n<meta name=\"twitter:site\" content=\"@ZineaLLC\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Zinea\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/2019\\\/01\\\/tracking-file-deletions-on-windows\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/2019\\\/01\\\/tracking-file-deletions-on-windows\\\/\"},\"author\":{\"name\":\"Zinea\",\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/#\\\/schema\\\/person\\\/e3c58d4f0650f7fb571c01fcf836b1d0\"},\"headline\":\"Tracking File Deletions on Windows\",\"datePublished\":\"2019-01-08T01:38:11+00:00\",\"dateModified\":\"2019-01-08T01:47:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/2019\\\/01\\\/tracking-file-deletions-on-windows\\\/\"},\"wordCount\":408,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/2019\\\/01\\\/tracking-file-deletions-on-windows\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/01\\\/nodelete.png\",\"articleSection\":[\"How-to\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zineausa.com\\\/blog\\\/2019\\\/01\\\/tracking-file-deletions-on-windows\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/2019\\\/01\\\/tracking-file-deletions-on-windows\\\/\",\"url\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/2019\\\/01\\\/tracking-file-deletions-on-windows\\\/\",\"name\":\"Tracking File Deletions on Windows - Zinea InfoSec Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/2019\\\/01\\\/tracking-file-deletions-on-windows\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/2019\\\/01\\\/tracking-file-deletions-on-windows\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/01\\\/nodelete.png\",\"datePublished\":\"2019-01-08T01:38:11+00:00\",\"dateModified\":\"2019-01-08T01:47:50+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/2019\\\/01\\\/tracking-file-deletions-on-windows\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zineausa.com\\\/blog\\\/2019\\\/01\\\/tracking-file-deletions-on-windows\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/2019\\\/01\\\/tracking-file-deletions-on-windows\\\/#primaryimage\",\"url\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/01\\\/nodelete.png\",\"contentUrl\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/01\\\/nodelete.png\",\"width\":1322,\"height\":1019},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/2019\\\/01\\\/tracking-file-deletions-on-windows\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Tracking File Deletions on Windows\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/\",\"name\":\"Zinea InfoSec Blog\",\"description\":\"Cyber Security Resources\",\"publisher\":{\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/#organization\",\"name\":\"Zinea LLC\",\"url\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/05\\\/zinea-square.png\",\"contentUrl\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/05\\\/zinea-square.png\",\"width\":876,\"height\":876,\"caption\":\"Zinea LLC\"},\"image\":{\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/zineausa\\\/\",\"https:\\\/\\\/x.com\\\/ZineaLLC\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zineausa.com\\\/blog\\\/#\\\/schema\\\/person\\\/e3c58d4f0650f7fb571c01fcf836b1d0\",\"name\":\"Zinea\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/81f66095634a4c974693824dc72cd0db7c7c44910d60dda2d1bf1be275ee107d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/81f66095634a4c974693824dc72cd0db7c7c44910d60dda2d1bf1be275ee107d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/81f66095634a4c974693824dc72cd0db7c7c44910d60dda2d1bf1be275ee107d?s=96&d=mm&r=g\",\"caption\":\"Zinea\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Tracking File Deletions on Windows - Zinea InfoSec Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/","og_locale":"en_US","og_type":"article","og_title":"Tracking File Deletions on Windows - Zinea InfoSec Blog","og_description":"If you are suspecting a user, process, virus, malware, or hacker deleting your files, you don&#8217;t have to buy expensive software to track what is deleting files. You can keep track of anything that deleted your files using Windows auditing. You need to have Windows Professional or better (Home will not work) to use this [&hellip;]","og_url":"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/","og_site_name":"Zinea InfoSec Blog","article_publisher":"https:\/\/www.facebook.com\/zineausa\/","article_published_time":"2019-01-08T01:38:11+00:00","article_modified_time":"2019-01-08T01:47:50+00:00","og_image":[{"width":1322,"height":1019,"url":"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/nodelete.png","type":"image\/png"}],"author":"Zinea","twitter_card":"summary_large_image","twitter_creator":"@ZineaLLC","twitter_site":"@ZineaLLC","twitter_misc":{"Written by":"Zinea","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/#article","isPartOf":{"@id":"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/"},"author":{"name":"Zinea","@id":"https:\/\/zineausa.com\/blog\/#\/schema\/person\/e3c58d4f0650f7fb571c01fcf836b1d0"},"headline":"Tracking File Deletions on Windows","datePublished":"2019-01-08T01:38:11+00:00","dateModified":"2019-01-08T01:47:50+00:00","mainEntityOfPage":{"@id":"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/"},"wordCount":408,"commentCount":1,"publisher":{"@id":"https:\/\/zineausa.com\/blog\/#organization"},"image":{"@id":"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/#primaryimage"},"thumbnailUrl":"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/nodelete.png","articleSection":["How-to"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/","url":"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/","name":"Tracking File Deletions on Windows - Zinea InfoSec Blog","isPartOf":{"@id":"https:\/\/zineausa.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/#primaryimage"},"image":{"@id":"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/#primaryimage"},"thumbnailUrl":"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/nodelete.png","datePublished":"2019-01-08T01:38:11+00:00","dateModified":"2019-01-08T01:47:50+00:00","breadcrumb":{"@id":"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/#primaryimage","url":"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/nodelete.png","contentUrl":"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2019\/01\/nodelete.png","width":1322,"height":1019},{"@type":"BreadcrumbList","@id":"https:\/\/zineausa.com\/blog\/2019\/01\/tracking-file-deletions-on-windows\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zineausa.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Tracking File Deletions on Windows"}]},{"@type":"WebSite","@id":"https:\/\/zineausa.com\/blog\/#website","url":"https:\/\/zineausa.com\/blog\/","name":"Zinea InfoSec Blog","description":"Cyber Security Resources","publisher":{"@id":"https:\/\/zineausa.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zineausa.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zineausa.com\/blog\/#organization","name":"Zinea LLC","url":"https:\/\/zineausa.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zineausa.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2018\/05\/zinea-square.png","contentUrl":"https:\/\/zineausa.com\/blog\/wp-content\/uploads\/2018\/05\/zinea-square.png","width":876,"height":876,"caption":"Zinea LLC"},"image":{"@id":"https:\/\/zineausa.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/zineausa\/","https:\/\/x.com\/ZineaLLC"]},{"@type":"Person","@id":"https:\/\/zineausa.com\/blog\/#\/schema\/person\/e3c58d4f0650f7fb571c01fcf836b1d0","name":"Zinea","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/81f66095634a4c974693824dc72cd0db7c7c44910d60dda2d1bf1be275ee107d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/81f66095634a4c974693824dc72cd0db7c7c44910d60dda2d1bf1be275ee107d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/81f66095634a4c974693824dc72cd0db7c7c44910d60dda2d1bf1be275ee107d?s=96&d=mm&r=g","caption":"Zinea"}}]}},"_links":{"self":[{"href":"https:\/\/zineausa.com\/blog\/wp-json\/wp\/v2\/posts\/252","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zineausa.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zineausa.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zineausa.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zineausa.com\/blog\/wp-json\/wp\/v2\/comments?post=252"}],"version-history":[{"count":4,"href":"https:\/\/zineausa.com\/blog\/wp-json\/wp\/v2\/posts\/252\/revisions"}],"predecessor-version":[{"id":276,"href":"https:\/\/zineausa.com\/blog\/wp-json\/wp\/v2\/posts\/252\/revisions\/276"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zineausa.com\/blog\/wp-json\/wp\/v2\/media\/272"}],"wp:attachment":[{"href":"https:\/\/zineausa.com\/blog\/wp-json\/wp\/v2\/media?parent=252"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zineausa.com\/blog\/wp-json\/wp\/v2\/categories?post=252"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zineausa.com\/blog\/wp-json\/wp\/v2\/tags?post=252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}