6

I use AllwaySync to synchronize a large number of music files across two external drives attached to Windows machines. Recently, several thousand of the files were deleted from one of the drives, and I'd like to determine the cause of this. Is there a way I can determine which process was responsible for the deletions? I know the approximate date and time of the event from looking at the AllwaySync high level log.

Improve this question

1 Answer 1

Reset to default
4

You can't do that post-mortem, sorry.

You can capture and record future deletions though. The keyword is "audit" and Windows has comprehensive support for auditing all sort of events including file deletions. There's more than one way to enable this, see for example here.

Alternatively, you can use Microsoft's ProcMon to monitor all system activity in real-time and set its filter to show only file deletions.

Improve this answer
1
  • In my case ProcMon never showed a delete event but filtering on the file path I was able to see a bad antivirus app at work making the file disappear with writes
    – rymo
    Jun 25, 2020 at 0:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .