event log question

[gs]

is there some sort utility from Microsoft I can use to analyze the security
log for logon/off event between specified interval? where can I get the info
as to what file were used during the session?

we discovered a loss of some folders and no one came forward

we did recover from backup. still trying to figure out what happened