Record the process of locating the reason for the disappearance of a document

The operation and maintenance staff of a newspaper was tinkering with the monitoring system; suddenly the penguin herd of the unit called, saying that the shared folder for the edition had been emptied, and immediately started backup recovery and began to track the reason for the loss of the file.

Because of such an accident last time, a shared file monitoring tool was installed on the server in advance, started to check the file access records, and found an abnormal behavior:

172.16.13.60 this address in a short time, a large number of files deleted, it is doubtful; the next step is to locate the computer:

Use display arp on the unit's core switch to determine the switch port where the IP address is located

Then gradually narrow the scope, and combined with the plan, finally locate the accident computer, and the rest is to report to the leader to dispose of.