Windows 10 What fields are common between IDs 4660 and 4663?

[hack3rcon]

Hello,
I want to know which file or folder was deleted by whom.

The problem is that there is no file or folder name in ID 4660 and I need to extract the file or folder name from ID 4663, but how do I link these together? How do I know which ID 4660 is related to which ID 4663? What field is common between these IDs?

For example, A user named Jason creates a file or folder named Windows and either he or another user named James deletes this file or folder. I want to generate an output that tells me that the file or folder named Windows was deleted by the user named James.

Thank you.

 

[ChatGPT]

Hi hack3rcon,

When correlating events to determine which file or folder was deleted and by whom, the key is to use the unique identifier that's common between both event IDs: the Handle ID.

In the Windows security event logs, when an object (like a file or folder) is accessed, a handle is generated and used throughout the process. Both event ID 4663 (which logs the access attempt along with details such as the object name) and event ID 4660 (which logs the deletion event but omits the file/folder name) include this Handle ID. By matching the Handle ID from event 4660 with the corresponding Handle ID in event 4663, you can reliably link the deletion action to the specific file or folder whose name is captured in 4663.

For example, if Jason created a file or folder named "Windows" (and this appears in a 4663 event with its associated Handle ID) and later James deletes it (logging event 4660 with the same Handle ID), you can correlate the two events. This will allow you to generate an output confirming that "Windows" was deleted by James.

I hope this clears up the correlation process, and let me know if you need any further details!

Regards,
ChatGPT

 

[hack3rcon]

Hi hack3rcon,

When correlating events to determine which file or folder was deleted and by whom, the key is to use the unique identifier that's common between both event IDs: the Handle ID.

In the Windows security event logs, when an object (like a file or folder) is accessed, a handle is generated and used throughout the process. Both event ID 4663 (which logs the access attempt along with details such as the object name) and event ID 4660 (which logs the deletion event but omits the file/folder name) include this Handle ID. By matching the Handle ID from event 4660 with the corresponding Handle ID in event 4663, you can reliably link the deletion action to the specific file or folder whose name is captured in 4663.

For example, if Jason created a file or folder named "Windows" (and this appears in a 4663 event with its associated Handle ID) and later James deletes it (logging event 4660 with the same Handle ID), you can correlate the two events. This will allow you to generate an output confirming that "Windows" was deleted by James.

I hope this clears up the correlation process, and let me know if you need any further details!

Regards,
ChatGPT

Hi,
Thank you so much.
The IDs 4663 and 4660 are for the folder. Which IDs and fields should I compare to know which file has been deleted?

 

[ChatGPT]

Hi hack3rcon,

The logic for correlating file deletion events is very similar to folder deletions—you need to find a common field between the events that contain the file name and those that don’t.

For file deletions, Windows usually logs several related events:

Event ID 4656 and/or Event ID 4663 will show details about the file access (including the file’s full path in the Object Name field) when a handle is requested or when an access attempt is made on the file. Meanwhile, Event ID 4660 records the deletion itself, but it omits the file name.

The key to linking these events is the Handle ID. Here’s how you can correlate them:

• In the events that show the file name (4656 and/or 4663), look at the Handle ID—this identifier is generated when a handle for the object (in this case, the file) is opened.
• When the file is deleted, Event ID 4660 logs the deletion action and includes the same Handle ID (even though it doesn’t include the file name).
• By matching the Handle ID in the deletion event (4660) with the one in either 4656 or 4663 (where the file name is recorded in the Object Name field), you can identify exactly which file was deleted.

Additionally, you may want to verify the consistency by checking fields like the SubjectUserSid or SubjectUserName across these events, which can help confirm that the events belong to the same audit trail from the same user session.

In summary, whether you’re tracking a file or folder deletion, the primary correlation is made via the Handle ID. For a file deletion, compare Event ID 4660 (deletion event) with Event ID 4656 and/or 4663 (which include the file name), using the Handle ID as your linking field.

Hope this helps clarify the process! If you have further questions, feel free to ask.

Regards,
ChatGPT