Link to home
Start Free TrialLog in
Avatar of Pau Lo
Pau Lo

asked on

local clues for files share access

What kind of history/evidence would their be locally on an XP machine of accessing files on a network file share? If any? I did some reading on *.lnk files, but I assume they'd be on the share itself not the client PC? Any other potential areas to investigate...
Avatar of epichero22
epichero22
Flag of United States of America image

Have you tried event viewer?
Avatar of Pau Lo
Pau Lo

ASKER

Any specific event evt file?
SOLUTION
Avatar of epichero22
epichero22
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Pau Lo

ASKER

Hmmm that log (if its security.evt) is empty!
Can you populate it with an event?  Try connecting to another computer and refreshing the screen.

Also you can go to Start->Run->"services.msc" and check if "Windows Event Log" has been turned off.
Avatar of Pau Lo

ASKER

I can't do as you say as we just have a replica copy of the drive. Local security policy which has an auditing section states no auditing to the 6 or so options.
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Pau Lo

ASKER

Thanks Ken, appreciate the pointers...
SOLUTION
Avatar of McKnife
McKnife
Flag of Germany image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial