File delete, whodunnit?

We've just installed a payroll manager on our NT4.0 TSE (Citrix Metaframe) server, for some reason the data files are deleted on exiting the programme, they're not in the Recycle bin, how do I find out who or what is deleting them?

The vendor says they've never seen this issue, obviously they don't support NT4 but the app is written in MS Access so I can't see why there should be any particular issues.

Any help appreciated.

To find which process and when, Filemon should do the job:

http://www.sysinternals.com/Utilities/Filemon.html

Thanks have just d/loaded