Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

My girlfriend is a lab technician at a small pharmaceutical startup. She created a very important Excel file and placed it in a shared folder on a server that the "IT" guy set up. The server runs Mountain Lion (OS X 10.8.2).

Last week, this important file went missing from this particular folder. There were several other files in this folder, but they didn't go missing.

She has since been able to recover the file from Time Machine, but wants to know how that file went missing. She assures me that no one in her department is careless enough to delete the file, but perhaps a higher-up with access to the shared file either accidentally moved/deleted the file (or did so deliberately due to the file's contents).

The issue here, is that due to a power struggle within the company, she suspects that someone may have attempted to sabotage (delete or move) this critical file which had data that could move the company forward faster in a particular direction than certain saboteurs would like.

The "IT" guys doesn't know much about server logs, etc. And I'm not a Mac expert. My question is this:

Is there a way to find out who deleted or moved this critical file? Are there file change logs located somewhere on the server that could "prove" this action?

share|improve this question
This is definitely going to have to be done by the IT guy on the server. A user accessing the share can't see any information about files that are no longer there. – NReilingh Oct 10 '12 at 2:00
Fair enough...but how can the IT guy do it? I think he literally needs instructions on how to do so. – B C Oct 11 '12 at 17:52
I've not provided this as answer as it's just a link and I don't have access to a Mountain Lion server (I have an earlier OS X server) to test, but this page about logs and scripts might be useful, particularly the section about 'AppleFileServiceAccess.log'. But also note that the author of that page indicates that those logs have to be activated in the first place, so this might not help your IT guy. – gentlemanhog Oct 11 '12 at 19:03

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.