6

My girlfriend is a lab technician at a small pharmaceutical startup. She created a very important Excel file and placed it in a shared folder on a server that the "IT" guy set up. The server runs Mountain Lion (OS X 10.8.2).

Last week, this important file went missing from this particular folder. There were several other files in this folder, but they didn't go missing.

She has since been able to recover the file from Time Machine, but wants to know how that file went missing. She assures me that no one in her department is careless enough to delete the file, but perhaps a higher-up with access to the shared file either accidentally moved/deleted the file (or did so deliberately due to the file's contents).

The issue here, is that due to a power struggle within the company, she suspects that someone may have attempted to sabotage (delete or move) this critical file which had data that could move the company forward faster in a particular direction than certain saboteurs would like.

The "IT" guys doesn't know much about server logs, etc. And I'm not a Mac expert. My question is this:

Is there a way to find out who deleted or moved this critical file? Are there file change logs located somewhere on the server that could "prove" this action?

Improve this question
7
  • This is definitely going to have to be done by the IT guy on the server. A user accessing the share can't see any information about files that are no longer there. – NReilingh Oct 10 '12 at 2:00
  • Fair enough...but how can the IT guy do it? I think he literally needs instructions on how to do so. – Doomd Oct 11 '12 at 17:52
  • 1
    Apple and Unix based systems in general, don't track file deletions. You can add software to track this sort of stuff, but it slows down the file system a bunch (Every file system write turns into two writes -- one for the change, and one for the log.) Worse: This sort of thing doesn't help with Black Hats that modify a file (You know that they modified it, but usually not how. And just opening an excel file seems to modify it. At least when I open it it asks if I want to save.) – Sherwood Botsford Jun 20 '13 at 12:15
  • 1
    A final possibility is that you post a copy of the file, and keep the original in your own home directory. If I worked there, I would keep a copy of everything on a thumb drive that was not connected to the computer too. – Sherwood Botsford Jun 20 '13 at 12:19
  • 1
    @SherwoodBotsford This may be trivial to track down. Clearly the group needs a new IT guy since auditing file deletions is a core concept for UNIX administration when you have business critical (let alone potentially the only copy of) work being stored. – bmike♦ Jun 22 '13 at 17:39
3

Yes - by default, file deletions are logged along with many other important file sharing events.

Install the Server app on any Mac (or log into the server to run the app there or inspect the log file locally).

enter image description here

Select logs on the left, select AFP Access Log on the bottom and search for the word Delete. Once you've found the file deletion you care about, note the IP address and timestamp. Then search backwards in this log to see what user logged in using that IP immediately prior to that delete event.

You might also seek professional help if you want a forensic analysis rather than performing it yourself. Anyone that can look at the logs can change the logs and how you use this knowledge is more of a social problem than a technical problem. There should be Time Machine or better backups of the server shares, so you should be able to trivially determine the times files are deleted there as well with tools like Backup Loupe and hopefully you find that someone was careless rather than deliberate. Either way, OS X server has sufficient logging to determine a file access oddity if it came from a user that connected to the share as opposed to logging in directly to the server and deleting the file. That event would need additional auditing and logging, but I would start with analyzing the AFP access log since that's normally how files are accessed from a server.

Improve this answer
1
  • Thank you. We figured this out a while ago...but I appreciate your detailed response (and the screenshot). Cheers. – Doomd Sep 3 '13 at 18:32
0

I am not computer savvy but I've learned a couple things which I'd be happy to share in case they help someone in the future.

If you're using a Mac server you should try screen sharing from your computer to the server and open the program called "Console" and check the logs between the time you last saw the file on the server (need to know the day and the TIME) and the first time you noticed the file missing. In "Console" you can see all the user's actions and what they've done on the server based on each computer's individual IP address.

You will have to go around to everyone's computer to find out their IP addresses, if you're all using Macs, open "System Preferences" and click on "Network" to see the Mac user's IP address. I'm not sure how to find IP addresses on Windows PC computers.

It takes a bit of sleuthing but you really need to know the time frames to help narrow down the search in the logs as there can be literally millions of tasks recorded in Console, also, you only have a certain amount of time before Console's history is no longer visible in the logs, so it is important to act fast and save a copy of the logs so you have proof of possible mischief.

Best to bring in an IT expert (someone you trust) to help you analyze the data and to help back up your claim of sabotage to your supervisor.

Good luck out there people!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .