Sysmon · Event 26
Sysmon Event 26: A file was deleted, but not kept
Sysmon noticed a file being deleted and recorded the fact. This is the lightweight half of a pair: Event 23 archives a copy of the deleted file, Event 26 only writes a log line. Choosing the wrong one of the two is how people end up with a full disk or no evidence.
Also written as Sysmon 26Sysmon Event ID 26FileDeleteDetectedsysmon file delete logged
- How oftenFires often
- Vendor calls itInformation
- LogMicrosoft-Windows-Sysmon/Operational
- SourceMicrosoft-Windows-Sysmon
What it means for you
For an analyst
The distinction between 23 and 26 is the operationally important thing here. Event 23 (FileDelete) copies the file into the archive directory before it goes, which is the only way to recover a payload that deleted itself — and which will fill a disk without a tightly scoped configuration and an archive cleanup job. Event 26 (FileDeleteDetected) logs the same act and keeps nothing. Configure 26 broadly for coverage and 23 narrowly for the handful of directories where you genuinely want the bytes. Note that the archive directory is protected by a System ACL and grows silently, so nobody notices until the volume is full.
The fields that decide it
Everything else in the log line is context.
- TargetFilename
- What was deleted. The directory is usually more informative than the filename — deletions in temp and download paths are constant, deletions in system directories are not.
- Image
- The process that performed the deletion. Explorer is a person; a script host, a service binary, or an unfamiliar executable is not.
- Archived
- Whether a copy was retained. False means the file itself is gone and this record is all that remains.
- User
- The account behind the deletion, which is what distinguishes a user tidying up from a service account removing something it should not.
- Hashes
- The file's hash where Sysmon computed it, allowing a deleted file to be matched against known-bad lists even though the file no longer exists.
Common questions
What is the difference between Sysmon Event 23 and Event 26?
Event 23 archives a copy of the file into Sysmon's archive directory before the deletion completes, so you can recover it afterwards. Event 26 records that a deletion happened and keeps nothing. Event 23 is far more valuable and far more expensive — configure it narrowly for specific directories, and use 26 for broad coverage.
Where does Sysmon store archived deleted files?
In the directory named by the ArchiveDirectory setting, C:\Sysmon by default, protected by a System ACL so ordinary users cannot read or empty it. It grows continuously and Sysmon does not clean it up for you, so an Event 23 configuration without a scheduled purge will eventually fill the volume. This is the single most common operational problem with the file-delete events.
Why do I see so many Sysmon Event 26s?
Because ordinary computing deletes files constantly — temporary files, browser cache, installer cleanup, build artefacts. The event only becomes useful when scoped. Exclude the paths that churn by design and keep the ones that should be stable, such as system directories, startup folders and application install locations.
Can Sysmon Event 26 help after a file has already gone?
Up to a point. The record tells you the path, the time, the process and the user, and where Sysmon computed a hash you can still match the file against known-bad lists even though the file itself is gone. What you cannot do is recover the contents — that requires Event 23 to have been configured for that path beforehand.
Read next
- Usually comes before Sysmon Event 11: A file was created File creation. A create followed shortly by a delete of the same path is the ordinary shape of a payload that cleaned up after itself.
- The equivalent of Sysmon Event 23: A file was deleted and archived The archiving version of this event, which keeps a copy of the file rather than only a record.
- Usually comes before Sysmon Event 1: Process creation The process that did the deleting, with its parent and command line.
- The equivalent of Event 4663: Something accessed a file, folder, or registry key Windows object access auditing, which records deletions but needs a SACL on every path.
- Related Sysmon Event 6: A kernel driver was loaded Driver loading, which often pairs with a delete when a driver is dropped, loaded, and removed.
Vendor documentation
Last reviewed 6 September 2026