Powershell script to track deleted files

Posted on 2012-08-13
Last Modified: 2012-08-15
Hi Guys,

I'm trying to track deleted files from our servers. I am able to pull either 560 or 564 using the following:

get-eventlog security | where {$_.eventID -eq 560}

The problem I have is that you need to read both events to make sense of what happened. You need 560 to find out what file was deleted and you need 564 to find out who deleted it.
These are linked by handle id.

Is there a way to pull both 560 and 564 which have the same handle id and group them together?
Also , when you pull event 560 using Powershell it doesn't show the file name and I don't know which property will bring it up, is there a way?

I have limited Powershell knowledge, but I'm guessing that you should be able to pull the 564 events, take the handle id from that event and find the 560 event that goes with it.
Then you just need to group the two together and show only the properties that show which file was deleted, who deleted it, what date and time and from what computer.

Any help would be greatly appreciated.


Question by:thomasmulligan
    LVL 52

    Accepted Solution

    get-eventlog security | where {$_.eventID -eq 560} | Select-Object -Property MachineName, TimeGenerated, entrytype, source, eventid, message

    Not sure how to club them basis the Event source data ... will check if i find something on this.

    - Rancy

    Author Comment

    Hi Rancy,

    Thanks very much, this gives me the details I am looking for.
    It would be ideal to be able to pull the 564 event that verifies the delete process has been completed, but what I have will do for now.

    Again, thanks for your help.


    Featured Post

    Do email signature updates give you a headache?

    Do you feel like you are constantly making changes to email signatures? Are the images not formatting how you want them to? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today.

    Join & Write a Comment

    Active Directory replication delay is the cause to many problems.  Here is a super easy script to force Active Directory replication to all sites with by using an elevated PowerShell command prompt, and a tool to verify your changes.
    The article will include the best Data Recovery Tools along with their Features, Capabilities, and their Download Links. Hope you’ll enjoy it and will choose the one as required by you.
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!

    732 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now