can you please share what you use to audit what files are deleted, when files are deleted and who deleted them?
thx
have a look at the command "bart". The Blog of Ben Rockwood