# encoding: ascii
# api: powershell
# title: Log 4 SP easy restore 
# description: Log SharePoint content deletions in all sites fora specified web application. Motivation was to determine content deletion dates to easily find the right backup for a selective restore.
# version: 0.1
# author: cglessner
# license: CC0
# x-poshcode-id: 1799
# x-archived: 2010-04-24T23:04:47
#
#
####### Log deletions in all sites in a web application ######

############# http://iLoveSharePoint.com ##################
############## by Christian Glessner ######################

################ begin config #################

# Url of the web application to audit. Don't forget to activate the delete audit log on sites you want to log.
$targetWebAppUrl = "http://localhost:100"

# Url of the web that contains the list to log (list must contains the following columns: "Title" (text), "Event Url" (Url), "Item Type" (text), "Event" (text), "Occurred" (DateTime), "User" (text)"
$logWebUrl = "http://localhost:100"

# Title of the log list
$logListTitle ="Audit"

################# end config ##################

$lastRunPropName = "_iLSP_lastAuditTimestamp"

[void][System.Reflection.Assembly]::LoadWithPartialName('Microsoft.SharePoint')

$logSite = New-Object Microsoft.SharePoint.SPSite($logWebUrl)
$logWeb = $logSite.OpenWeb()
$logList = $logWeb.Lists[$logListTitle]

$targetWebApp = [Microsoft.SharePoint.Administration.SPWebApplication]::Lookup($(New-Object Uri($targetWebAppUrl)))

if($targetWebApp.Properties.ContainsKey($lastRunPropName) -eq $false)
{
	$targetWebApp.Properties[$lastRunPropName] = [DateTime]::MinValue
	$targetWebApp.Update()
}

$lastRun = [DateTime]::Parse($targetWebApp.Properties[$lastRunPropName].ToString())
$newRun = [DateTime]::Now.ToUniversalTime()

foreach($site in $targetWebApp.Sites)
{	
	$query = New-Object Microsoft.SharePoint.SPAuditQuery($site)
	$query.AddEventRestriction([Microsoft.SharePoint.SPAuditEventType]::Delete)
	$query.SetRangeStart($lastRun)
	$query.SetRangeEnd($newRun.AddDays(1))
	
	$result = $site.Audit.GetEntries($query)
	
	if($result.Count -gt 0)
	{
		foreach($entry in $result)
		{
			$eventUrl = $site.Url + "/" + $entry.DocLocation
			
			$item = $logList.Items.Add()
			$item[[Microsoft.SharePoint.SPBuiltInFieldId]::Title] = $entry.DocLocation
			$item["Event Url"] = $eventUrl
			$item["Item Type"] = $entry.ItemType
			$item["Event"] = $entry.Event
			$item["Occurred"] = $entry.Occurred.ToLocalTime()
			$item["User"] = $logWeb.SiteUsers.GetByID($entry.UserId).LoginName
			$item.Update()
			
		}
	}
	
	$site.Dispose()
}

$targetWebApp.Properties[$lastRunPropName] = $newRun
$targetWebApp.Update()

$logWeb.Dispose()
$logSite.Dispose()
