You can turn on File and Object Access as well as Process Tracking under auditing (at a price to the server responsiveness) and then cull the Event Viewer for that information. It would probably be easier to also employ 3rd party tools for retrieving the Event Viewer information. There are also stand alone software packages available that say they can do what your asking Jason. If worked on, it should be possible to do with KiXtart Les.