How to create a search to find who deleted a file? (4237807)

You can search for the File Deletion event or for changes made to the folder path (if known).

1. Create a search for the File Deletions:
   • Create a new search
   • On the What tab of the search click the down arrow next to Add and select Event Class
   • Under the Event Class column type File Deleted
   • Select the Event and click Add | Add This Event
   • Run the Search to return all file deletions.
   • You can further refine the search by specifying a date or range on the When tab.
   • You can also add the File Name to the Layout of the Search allowing you to filter the search results by File Name.
   • Click the Layout tab
   • Under Unselected Columns select File Name and click >
   • Run the Search again and you can then enter the file name under the File Name column
2. Create a search for changes made to the path:
   • Create a new search
   • On the What tab of the search click the down arrow next to Add and select Subsystem | File System
   • Select This object and All Child Objects
   • Enter the path where the file was deleted from and click Add
   • Run the new search