This morning one of the managers had called and asked about a specific file on a file share. I told her we could most likely find out who modified it by searching the event log since we have auditing enabled. However - it's now 8/14 and this file was changed on 8/8. When I look in the event viewer 8/8 is no longer there and the security properties are set to Overwrite as needed.
Is there a way to get log files back or are they gone forever? Mind you this is a 2003/File server as well.
