capture deleted file