Thank you Ed again.
I, We don't think it's as serious as to take it to the court. We just only need to know why and who did it and are ready to listen to his excuse or whatever.
Anyway I followed your instruction and checked two of options in the audit panel; 'loged on and off' and 'file ...access' (please understand we don't use English NT so I assume and translate every terms).
Do you think it's enough to find all the history of the files from generating to deletion ?
Oh! Let me ask you one more thing. Where is the place that I can make all the deleted files moved to the trash bin ?