Welcome to OStack Knowledge Sharing Community for programmer and developer-Open, Learning and Share
Welcome To Ask or Share your Answers For Others

Categories

0 votes
1.4k views
in Technique[技术] by (71.8m points)

请问 windows 如何像 Linux 使用命令方式查询某个文件夹底下的删除纪录?

请问 windows 如何像 Linux 使用命令方式查询某个文件夹底下的删除纪录
想要这样的效果

$ logs D:xxxxxx --filiter-event "deleteEvent"

Date:2020-10-01 12:05:03.001,FilePath:D:xxxxxx1.txt,User:user01
Date:2020-10-01 12:05:07.001,,FilePath:D:xxxxxxyyy1.txt,User:user02

与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome To Ask or Share your Answers For Others

1 Answer

0 votes
by (71.8m points)

磁盘应该是 NTFS 格式吧,NTFS 格式,有USN日志记录文件创建、删除、加密、目录创建、删除等操作背后的原因.
你看下这篇文章 https://www.anquanke.com/post/id/86265


与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome to OStack Knowledge Sharing Community for programmer and developer-Open, Learning and Share
Click Here to Ask a Question

...