Hi,
Have you enabled the CIFS audting option? e.g:
>cifs.audit.enable on/off
If you enter "options cifs.audit" on your appliance, you will see all the available options for auditing.
The CIFS Audit log should capture the information you need, but obviously this will only be for future CIFS actions etc.
Check the log size and interval, otherwise your audit log maybe overwritten before you capture the information you require.
Hope this helps
Thanks