Who Deleted My File? Use PowerShell to Find Out
Someone deleted a file — but who?
In this short tutorial, learn how to track file deletions using PowerShell and the Windows Security log.
Catch the culprit in under 60 seconds. No guessing. Just logs.
🔧 Commands used:
✅ Enable File System Auditing:
auditpol /set /subcategory:"File System" /success:enable /failure:enable
✅ Find deleted file events (Event ID 4660):
Get-WinEvent -FilterHashtable @{
LogName = 'Security'
ID = 4663
StartTime = (Get-Date).AddDays(-1)
} | Where-Object {
$_.Message -like '*Delete*'
} | select *
🛡️ Make sure folder auditing is enabled via:
Right-click folder → Properties → Security → Advanced → Auditing.
🧠 Tip: The logs never lie. People might.
📌 Like, subscribe, and drop a comment if you caught your file thief.
#PowerShell #WindowsLogs #FileDeleted #SysAdmin #ITTools