We have a samba share that is not used very much and when it is the files are not be modified very often. The share will hold sensative information and it is vital we can see what information the file contained for auditing purposes. I am not sure of the behaviour of the recycle bin when the contents of an existing file are modified. I am told that modifing a file actually deletes the original and creates a new one (this may be over simplistic). If this is the case, then I would expect the original file to appear in the "recycle bin". Indeed this is what I would WANT. I suspect that the actual behaviour only creates a recycled item with a "proper" delete from the user. Can anyone confirm ?