Yesterday I received a call from a user who needed a document recovered. She said that on Monday morning the document contained all the changes she was working on for the past week, but today these changes are gone. She claimed that she had the document checked out for the past week while she was making her changes. The audit log supports that. I spent a couple of hours yesterday finding the root cause as to why her changes disappeared. I ran custom audit reports and found that she checked out version 1 of the document 7 days ago. Then yesterday the log indicates that version 1 of the document was checked out again. My suspicion is that she accidently discarded her check out and then checked out the document again. My question is how do I prove this? The audit log is lacking. It does not indicate a discard check out action. Has anyone else come across this issue? In the end, I was able to restore the content database and recover the file at a point where she still had it checked out. Btw, this is the first time since we deployed MOSS 2007 that I have had to restore from a backup. Thanks, Tom

It is lacking but check out this thread, i looked it over and there is some solution moving forward.. http://social.technet.microsoft.com/Forums/en-US/sharepointgeneral/thread/fd59c175-cb7c-4e6d-ad8f-abc8c204ba97 Rock Posted the following... If you want to check which item is deleted, you can click deletion button under content activity report. Based on my test, by default when you copy a file via send to another place, it’s correspond event is update. If you want to get such an event like copy, you may need to write code to achieve that. Following is a complete list of the different enumeration values that are available for SharePoint 2007. SPAuditMaskType.CheckIn SPAuditMaskType.CheckOut SPAuditMaskType.ChildDelete SPAuditMaskType.Copy SPAuditMaskType.Delete SPAuditMaskType.Move SPAuditMaskType.ProfileChange SPAuditMaskType.SchemaChange SPAuditMaskType.Search SPAuditMaskType.SecurityChange SPAuditMaskType.Undelete SPAuditMaskType.Update SPAuditMaskType.View SPAuditMaskType.Workflow For more information about Item-Level Auditing with SharePoint Server 2007, please refer to the following articles: SPAuditMaskType Enumeration (Microsoft.SharePoint) http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spauditmasktype.aspx Item-Level Auditing with SharePoint Server 2007 http://msdn.microsoft.com/en-us/library/bb397403.aspx MOSS 2007 Item-Level Auditing Source Code and White Paper Released http://blogs.msdn.com/joanna_bichsel/archive/2007/01/11/item-level-auditing-source-code-and-white-paper-released.aspx Thanks! Rock WangKris Wagner, MCITP, MCTS Twitter @sharepointkris Blog: http://www.sharepointkris.com/blog