I am fairly sure that by activating the audits on the server you should be able to see who is deleteing the files. It should be shown in your security log file. You should only activate the audits...