Analysing File Deletions

Is there a way to find out which user deleted a particular file in Win 2k3?

Only if you auditted the event.

http://www.lockergnome.com/nexus/it/...diting-part-i/

I had to provide testimony recently on an executive who decided he would get back at a few people on the way out the door while it hit him in the ass. Bottom line, have your sh!t and methodology covered and audited. It's not the time when your entire core function is gone (temporarily of course) to find out you do not audit file changes and cannot track who deleted important data. Plus you then look cool and suave when that lawyer "thinks" he can make you cry like Nancy Kerrigan.