How can I know if files have been deleted or the recycle bin emptied?

Is there any way to know if files have been deleted or the recycle bin emptied in Windows 10? Can Event Viewer show this?

Any help much welcome

Windows 10 20H2

Windows does not log file deletions unless file and folder auditing has been configured, and it isn't by default. This auditing is very fine grained and would impact performance and consume a lot of space unless configured according to your needs.

I don't know about emptying the recycle bin.

That's an interesting question. I would use Sysinternals/TechNet's small, free and portable Process Monitor (ProcMon).

ProcMon has a learning curve and you will no doubt find that you need to filter for both the group event (i.e. Show File System Activity from ProcMon's toolbar) and the specific event itself, otherwise you (and your device's swapfile) will be overwhelmed with unnecessary information (unless you choose the often necessary option to Drop Filtered Events from the Filter menu - note that this is a persistent setting!).

The problem is that there is no apparent specific 'DeleteFile' or 'FileDelete' event to watch for. As a result, the closest I can find is to filter on a specific filepath and watch what happens.

Emptying the Recycle Bin is a different event but this can be captured. For example, you can filter for operations where the filepath begins with C:\$RecycleBin\:



Hope this helps...

I assume you have the Recycle Bin icon on your desktop? In my case this icon looks like a waste paper basket that is full of paper if there is even one file in it. If there are no files in it (empty) then the icon changes to show nothing in the basket and the basket is translucent. A simple way to see that it is empty just by looking at the icon.