Solving The Mystery - Who Deleted That File

Have you ever experienced a scenario, where a file has been deleted from a machine and you are wondering who deleted the file and had no idea who was the culprit? Good luck! In this article, I will try to explain a technique available on the Windows machine to find out who deleted the file.

Motivation

The urge for writing this article comes from an issue in our production environment and it might be useful for readers if ever they encounter such an issue. Our problem started when one of our production servers went out of the load balancer. We had recently deployed an Asp.net core 2.x application, which was deployed as a Self-Contained Application. In a self-contained deployment, the complete .net core framework is bundled in a folder and it also includes your asp.net core Exe which is launched by the IIS server. In our scenario, the exe was being deleted, which was causing 502.5 process error as the Host Process couldn't be started. Since the production server has restricted access, it wasn't possible that a user was deleting the file. It was a sporadic delete operation and happened on some servers while others were working fine. This was the inspiration for identifying how the exe was getting deleted. If you are interested in more details, then refer the GitHub issue.

If you couldn't follow the above reasoning, you may be able to possibly relate to the following scenario where the need to find out who deleted the file is important.

• A Shared folder among the team has certain files deleted.
• The deployed application is missing certain files.

Windows offers the built-in Audit feature using various policies which allow us to audit the access requests, audit login, process tracking, and more.

The following 3 step process would help us in identifying who deleted the file.

1. Turn on the File Auditing Process on the System.
2. Configure the Audit process on the File/Folder to be monitored.
3. Verify the Audit Logs to get details of who deleted the file.

Note
You will require the Admin permissions on the machine where the File Auditing needs to be set up.

Let's dig into these steps further in detail.

Operating Systems offers the functionality to track various file operations. These features are configurable and can be turned Off/On using Policies. Windows uses the concepts of Policies to manage various settings which influence what can be done on the machine.

Wikipedia defines the Group Policy as, "a feature of the Microsoft Windows NT family of operating systems that controls the working environment of user accounts and computer accounts."

There are Group Policies which apply to all computers in a domain and Local Policies which apply to the local computer only. Group Policies are configured by Network admins. In this instance, we are going to change the Local Policy. Please note that windows Policies wouldn't work for Windows Home edition. You need to have a professional or enterprise edition of Windows.

• Navigate to the System which needs monitoring and opens the Local Group Policy Editor by either entering gpedit.msc in the Run menu or typing in Group Policy in the Windows Search.

The Local Group Policy will appear as shown below.

• Select the Object Access Section on the left tree, by navigating to Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -Local Group Policy Object -> Object Access
  
  
• Select the Subcategory for Audit File System, and then right click or double click on the subcategory. Another window pops-up, Audit File System Properties. Check the Checkboxes for the Success and Failure conditions under the Condition the following event for checkbox as shown below.

With the above-mentioned steps, we have enabled the File System Auditing on the Operating System. Next, we will explore how to set up logging for the Folder which needs to be monitored.

Basically, in this step, we will define what kind of File System Access (Read/Write/Delete) needs to be monitored and what Users & Roles need to be tracked.

• Select the folder in the Windows Explorer which needs to be monitored for the file deletion.
• Right click on the folder, go to properties, Navigate to Security Tab and then click on the Advanced button as shown below.

• A dialog named *Advanced Security Settings for * would open. Go to Auditing Tab, and then click Continue. Note: You must be an administrator to define the Auditing policy.