# How to View Employees' File Operation Records Canonical: https://www.nsecsoft.com/en/course/file-operate.html Language: en-US Updated: 2026-11-04T08:05:42.99853Z Rather than focusing only on whether an outflow occurs in the end, File Operation records are more suitable for observing employees' pre\-operations on the endpoint, such as opening, copying, deleting, moving or renaming files, etc\. For security administrators, such records can help restore the local operation track of files and provide earlier behavioral clues for \[…\] Rather than focusing only on whether an outflow occurs in the end, **File Operation** records are more suitable for observing employees' pre-operations on the endpoint, such as opening, copying, deleting, moving or renaming files, etc. For security administrators, such records can help restore the local operation track of files and provide earlier behavioral clues for events such as outbound files, deletions, and abnormal downloads. In daily audits, it is recommended to use **File Operation** records as the "process audit" entrance, and **Leak Tracking** and **File Backup** as the "result audit" entrance. The combination of the two can more completely determine the life cycle of a file on the endpoint. Click **Data Security** → **File Operation** on the Ping32 Management Console to view the audit records of employee file operations. #### **File operation types that support auditing** - Open - copy - delete - download - New - move - Rename #### **Filter audit data** Click the **Filter** button to conditionally filter the audit data. ![]() Example: View only the "deletion" record of a certain endpoint View the "Delete" records of all endpoints #### **Usage suggestions** - If the administrator is troubleshooting outbound file transfer events, he or she can first check whether the target file has any abnormal pre-actions such as copying, renaming, and moving locally. - If the administrator is checking for accidental deletion or malicious deletion, he can prioritize **deletion** related records and then compare them with the **file backup** results. - For key endpoints, it is recommended to conduct cross-screening based on time range, operation type and endpoint name to narrow the scope of investigation. #### **Typical usage scenarios** In actual work, **File Operation** records are particularly suitable for the following scenarios: First, when employees leave and hand over or their positions are adjusted, check whether there is centralized copying and moving of data; second, when important files are lost or replaced, check whether deletion, renaming or movement has occurred; third, after an external event occurs, trace back the preparation process of relevant files on the endpoint. By connecting these pre-operations with subsequent outgoing, deletion, and backup records, it is easier for administrators to draw reliable conclusions.