I have just been askek to find out what files an ex employee had copied off our very small business network before he left last week, my problem is that no specific monitoring software has been setup. Is there anyway in vista to find this information, maybe even a file list of latest copied files would even do.Also, is there a way to find a log file for any optical media which has been burnt off the vista machine as I am pretty sure that is how he removed the files.Any information would be greatly appreciated.CheersJosh

Hi Josh I'm not aware of any default component in Windows that creates a persistent log file of File Copy or CD Burning activity. This would be in the realm of third party user monitoring tools. If a user is doing something that they should not be doing, they are prone to making mistakes, such as copying files and then deleting the files, but neglecting to empty the Recycle Bin. You might want to check that folder. If this installation is Vista Business, Enterprise, or Ultimate, you can also use the 'Previous Versions' component to recover deleted files. If the files were actually removed, and if you know the folder or folders where the removed files may have been located, you can 'copy' the parent folder for those folders to a different location and then compare that shadow copy version to the existing folder to determine which files have been removed. To do this, right click the parent folder and select Properties/Previous Version Tab. After the previous versions list populates, select a version for a Date and Time prior to when you think the removal may have taken place. Click the Copy Button. Select a location, preferably an external drive. Click the Copy Button to copy the previous version to that location. Let us know if this works for you. If this post helps to resolve your issue, click the Mark as Answer button at the top of this message. Ronnie Vernon Microsoft MVP Windows Desktop Experience