User reports "missing" docs - audit trails show user destroy action.

jklawrence

I have a user who occasionally reports "missing" documents.  Review of the audit trail shows a destroy action under the user's name, but she consistently denies deleting the document.  Since she is the owner, she has delete permissions.

Does anyone have any ideas on how to track what's going on?  In the audit log the string_1 value is blank for the dm_destroy event (where as it is "Save" for the dm_save events) and the event_description is "Default Event Set".

Thanks.

DCTM_Guru

Some users will always claim that they didnt do X.  What I have done on past projects is to implement soft delete (aka recycle bin).  This way it doesnt matter if they claim that they didnt delete, we just recover it.  Here's some sample code (its old, but should still work):

https://developer-content.emc.com/developer/componentexchange.htm#0900c355809ecaaa

jklawrence

Johnny,

Thanks much for the link to the code.  We just may have to implement that, although I'd sure like to know what's going on.

- Jane

DCTM_Guru

Whether she intentionally deleted it or not, the audit trail doesnt lie

One thing that could have happened was that she deleted the parent folder not knowing that the document was in there.

kscdennis

Take this user's delete permissions away.