Have you ever lost an important file on your computer and not known who deleted it? It can be frustrating and even concerning if you suspect someone else might have accessed your computer. Fortunately, there are several methods you can use to check who deleted a file on your Windows computer. In this article, we’ll describe the steps involved in each method, including any tools or software you may need.
Video Tutorial:
The Challenge of Checking Who Deleted A File in Windows
One of the challenges of checking who deleted a file in Windows is that by default, the operating system does not track this information. This means that if you want to find out who deleted a file, you’ll need to take additional steps to enable this tracking or use third-party tools that can help you access this information.
Another challenge is that even if you are able to track who deleted a file, you may not necessarily be able to recover the file itself. This will depend on various factors, such as how the file was deleted and whether it was permanently deleted or simply moved to a different location.
Things You Should Prepare for
Before attempting to check who deleted a file on your Windows computer, there are a few things you should prepare for:
1. Admin privileges: You will need administrative privileges on your computer to access certain system files and to use some of the tools and methods we describe in this article.
2. File path: You will need to know the path where the file was located before it was deleted. This will usually involve navigating to the folder or drive where the file was stored.
3. Third-party tools: If you prefer to use a third-party tool to check who deleted a file, you will need to download and install this tool before you can use it.
Method 1: Use Event Viewer
Windows Event Viewer is a built-in tool that logs various system events, including file and folder access. By reviewing the Event Viewer logs, you can often determine who deleted a file on your computer. Here’s how to use Event Viewer to check who deleted a file in Windows:
1. Press the Windows key + R to open the Run box.
2. Type "eventvwr.msc" and hit Enter to open Event Viewer.
3. In the left pane, click Windows Logs, then select Security.
4. In the right pane, click Filter Current Log…
5. In the Filter Current Log window, enter the following information:
- Event sources: Security
- Event IDs: 4660 (this is the ID for file or folder deletion)
- User: enter the name of the user you suspect deleted the file (optional)
6. Click OK to apply the filter.
7. Look for entries in the log with an Event ID of 4660 that match the date and time the file was deleted. These entries should contain information about who deleted the file and from where.
Pros:
– Event Viewer is a built-in Windows tool, so you don’t need to install any additional software.
– Checking the Event Viewer logs can give you a comprehensive view of all file and folder access on your computer.
Cons:
– Depending on the size of your hard drive and the number of events recorded in Event Viewer, searching for the relevant log entry can be time-consuming.
– If you suspect that the file was deleted a long time ago, there may not be any relevant entries in the log.
Method 2: Use Third-Party Recovery Software
If you are unable to find any information about who deleted a file using Event Viewer or if you suspect that the file was permanently deleted, you may be able to recover the file using third-party file recovery software. These tools can scan your hard drive for deleted files and recover them if they are still intact. Here’s how to use EaseUS Data Recovery Wizard Free to recover a deleted file and find out who deleted it:
1. Download and install EaseUS Data Recovery Wizard Free on your computer.
2. Launch the software and select the drive where the deleted file was located.
3. Click the Scan button to start the scan.
4. Once the scan is complete, you should be able to see a list of recoverable files, including the one you are looking for.
5. Look for a column called “Owner” in the results. This column should show the username of the person who deleted the file.
Pros:
– Third-party file recovery software can often recover deleted files that you may not be able to recover using other methods.
– Recovery software can often provide additional information about who deleted a file, such as the username of the person who performed the deletion.
Cons:
– Recovery software can be expensive, particularly if you need to purchase a commercial license for more advanced features.
– Depending on the extent of the damage to the deleted file, recovery may not be possible.
Method 3: Use File and Folder Auditing
Windows provides built-in file and folder auditing tools that you can use to track file and folder access, including deletion. By enabling file and folder auditing, you can create a log that tracks all instances of file access, including who accessed the file, when it was accessed and what was done with it. Here’s how to enable file and folder auditing in Windows:
1. Open Windows Explorer and navigate to the folder or file that you want to audit.
2. Right-click on the file or folder and select Properties.
3. Click on the Security tab, then click the Advanced button.
4. Click on the Auditing tab, then click the Edit button.
5. Click the Add button, then enter the name or names of the users or groups you want to audit.
6. Select the Full control option from the list of permissions to audit, then click OK.
7. Check the box next to "Delete", then click OK.
8. Click OK again to close the Properties window and apply the changes.
Pros:
– File and folder auditing can provide a comprehensive log of all file and folder access, including deletions.
– Auditing is built into Windows, so you don’t need to install any additional software to use this feature.
Cons:
– Auditing can be resource-intensive, especially if you are auditing a large number of files or folders.
– Reading the audit logs can be time-consuming, especially if there are a large number of events to review.
Why Can’t I Check Who Deleted A File in Windows?
Checking who deleted a file in Windows can be challenging for several reasons:
1. Default settings: By default, Windows does not track who deleted a file, so you will need to enable tracking or use third-party tools to access this information.
2. Permissions: If you do not have administrative privileges on your computer, you may not be able to access certain system files or use certain tools and methods for tracking file access.
3. Time delay: If you do not discover that a file has been deleted until some time has passed, the Event Viewer logs may no longer contain relevant information about who deleted it.
Fixes:
1. Enable file and folder auditing to track file access and deletions.
2. Use third-party file recovery software to recover deleted files and access information about who deleted them.
3. Keep regular backups of your important files to reduce the impact of file deletions.
Additional Tips
Here are a few additional tips to keep in mind when checking who deleted a file in Windows:
1. Check the Recycle Bin: If you suspect that a file has been deleted, check the Recycle Bin first. Sometimes files can be accidentally deleted but still be recoverable from the Recycle Bin.
2. Use version history: If you have enabled File History or System Restore on your computer, you may be able to recover previous versions of the file you are looking for.
3. Check user accounts: If you suspect that a user account on your computer has been compromised, you may be able to find evidence of this in the Event Viewer logs.
5 FAQs About Checking Who Deleted A File in Windows
Q1. Why does Windows not track who deleted a file by default?
A1. By default, Windows does not track who deleted a file because this information can take up significant resources and may not be necessary for most users.
Q2. Can I recover a deleted file if I don’t know who deleted it?
A2. Yes, you may be able to recover a deleted file using file recovery software even if you don’t know who deleted it.
Q3. Can I recover a file that was permanently deleted?
A3. It depends on various factors, such as how the file was deleted and whether it was overwritten by other data. In some cases, it may be possible to recover a permanently deleted file using file recovery tools.
Q4. Can I use file and folder auditing to track who copied or moved a file?
A4. Yes, file and folder auditing can be set up to track a wide range of file and folder access, including copying and moving files.
Q5. Can I use file and folder auditing to track who accessed a file remotely?
A5. Yes, file and folder auditing can be set up to track remote file access using protocols such as SMB and NFS.
In Conclusion
Checking who deleted a file in Windows can be a frustrating experience, but with the right tools and methods, you can often find out who deleted a file and when it was deleted. Whether you choose to use built-in Windows tools such as Event Viewer and auditing or third-party software such as EaseUS Data Recovery Wizard, it’s important to act quickly to maximize your chances of recovery. By following the steps outlined in this article and taking appropriate precautionary measures, you can protect your important files and information from accidental or intentional deletion.