Deleted files...maliciouslly??

[scooby]

Came into work this morning to find a few folders missing that contained client data. I checked the firewall logs along with security logs from server. both logs were intact with information from the past few days and nothing out of the ordinary listed. As a result of the logs not missing and not showing any logons i conclude that it was internal? I had been auditing a few folders for a particular user before. Unfortunately i wasn't auditing deletions on all folders for all users. I enabled the auditing today for all data folders.

Is there a way the person could have removed individual lines from an event log??

Could have been an accidental deletion but the way the folders were layed out an accident is a bit suspect.

Any advice from others this may have happened to would be appreciated.

I was able to restore everything from backup but unfortuntalely it happened before this past week's full backup. Still only lost a few days worth of data and not much activity had occurred in these folders.

Thanks