File auditing is the recording of activity involving files, such as who opened, copied, moved, renamed, or exported a document and when. Depending on the system, logs may also capture the user account, device, location, or action result.
In cyber security, these records help organizations detect unusual access, investigate suspected data loss, and understand how sensitive information moved. For example, an audit trail may reveal repeated downloads or exports by an account that normally does not handle those files. Auditing works best alongside least-privilege permissions, alerts, and retention policies; logs alone do not prevent copying, and incomplete or poorly protected records can limit investigations.