can you try applying this: Apply a basic audit policy on a file or folder - Windows 10 | Microsoft Learn to the AppData\Local\crystal\cache folder?
I haven’t test it yet but supposedly it will log some event whenever a delete event happens
1 Like