Run Audit Log Windows + SNARE

http://cyberoperations.wordpress.com/2012-class/05-windows-logging-and-file-sharing/

http://www.neondemon.com/archives/how-to-monitor-file-and-folder-access-on-a-windows-file-server

http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/