I need to know which user deleted file in filesystem from c# code. Only one idea is to use audit, but it seem to be very slow...
+1
A:
You can use the FileSystemWatcher.Deleted event to capture deletes happening on the filesystem.
Depending on the application, you may at that point also be able to find out what user caused this event to occur (it is not part of FileSystemEventArgs).
Oded
2010-03-30 11:04:29
in fact. i'm using watcher, but when i try to get username like this:System.Security.AccessControl.FileSecurity sec = new FileSecurity(Path, System.Security.AccessControl.AccessControlSections.Owner);return sec.GetOwner(typeof(System.Security.Principal.NTAccount)).Value;it throws an exception due it can't determine user
2010-03-30 11:10:20
@user: Try `WindowsIdentity.GetCurrent().Name` http://msdn.microsoft.com/en-us/library/system.security.principal.windowsidentity.aspx
KMan
2010-03-30 12:32:06
+1
A:
I don't know if this can be retrieved from the filsystem, but one possible way is to use av FileSystemWatcher object to trigger an event on Deleted. The downside is that you need to have the watcher application running all the time. One upside is that you can monitor just a spesific folder if that's feasible.
sindre j
2010-03-30 11:04:55
seems that FileSystemWatcher doesn't provide information about user who deleted file...
2010-03-30 11:13:59
No, but I tought maybe it could be accessed through the file. You would have to get the user who changed the file, not the owner. But anyway, the file is probably already deleted then. That's why you get the exception I guess.
sindre j
2010-03-30 13:15:31
Maybe you could figure out how to access the file information of the deleted file from this source code? http://ntfsundelete.com/downloads/
sindre j
2010-03-30 13:22:18