Folder creation and Deletion logs (Proof)

Question

Hi,

I have a folder as D:\MyFavoriteDirectory.

I would like to get the time stamps of when this directory was created and when it was deleted. Is it possible to achieve this in VB.Net of PowerShell?

Answer 1

These attributes of files and directorys are available: CreationTime, LastAccessTime, and LastWriteTime

But once an item is deleted there's no longer any record of it. That's just the way the file system works. So, not so much a PowerShell thing. :-)

You can, however, enable auditing of actions in security policies (either GPOs or Local).

If you running Windows 10 or 11 the machine isn't a domain member, run SecPol.msc. You'll find the Audit File System in the Advanced Audit Policy Configuration -> System Audit Policies -> Object Access. You can choose to audit success or failure. Then open the properties of the file system directory and "Advanced". Select the Audit tab and add what you want to audit.

After that you can periodically look for the appropriate events in the security log. Just keep in mind that the security log can fill up pretty fast, and if you don't record when a directory/file was created there's no way to retrieve that information if the log file's been overwritten.

Answer 2

Use FileSystemWatcher