Windows File Access Auditing

Local Security Policy –> Security Settings –> Local Policies –> Audit Policy –> Audit object Access –> Enable Success & Failure

Locate the folder or file you want to audit –> Properties –> Security –> Advanced –> Auditing –> Select a principal: Everyone –> Type: All –> Show advanced permissions –> add Delete subfolders and files, Delete

Event Viewer –> Event Viewer (Local) –> Windows Logs –> Security –> Find –> type file name and search