Announcement

Collapse
No announcement yet.

what files have been copied

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • what files have been copied

    Hello,

    Can you please tell me if you know a tool whic will tell what files have been copied ( from network - Windows 2003 or from local station - Windows XP) to a flash USB ?

    Thank you!

  • #2
    Re: what files have been copied


    Do you have the USB flash drive and want to compare the two?
    Or do you want to know if files in general have been copied off your network?
    "...if I turn out to be particularly clear, you've probably misunderstood what I've said” - Alan Greenspan

    Comment


    • #3
      Re: what files have been copied

      Originally posted by Lior_S View Post

      Or do you want to know if files in general have been copied off your network?
      Yes, I would like to know what files are copied from network to USB flash.

      Comment


      • #4
        Re: what files have been copied

        Unless you have auditing enabled (by default it is not) there is no way to see what files where copied.
        "...if I turn out to be particularly clear, you've probably misunderstood what I've said” - Alan Greenspan

        Comment


        • #5
          Re: what files have been copied

          Originally posted by Lior_S View Post
          Unless you have auditing enabled
          Given the fact that the OP wants both from network (Windows 2003 Server) and from the local station, that will be a lot of auditing...
          I am asking myself if there's a way to get a notice when someone connects a USB pen...

          Sorin Solomon

          »»»»»
          In order to succeed, your desire for success should be greater than your fear of failure.
          -
          «««««

          Comment


          • #6
            Re: what files have been copied

            Originally posted by sorinso View Post
            I am asking myself if there's a way to get a notice when someone connects a USB pen...
            There are third party utils
            or you can disable all USB ports
            or you can use XP SP2 and make them read only

            but if there is some way to get a notification that would be cool

            maybe a script that continually scans all hardware, when it encounters a USB device raises a flag....I am not a scripting guy.....
            "...if I turn out to be particularly clear, you've probably misunderstood what I've said” - Alan Greenspan

            Comment


            • #7
              Re: what files have been copied

              Thank you for your help!

              Originally posted by sorinso View Post
              Given the fact that the OP wants both from network (Windows 2003 Server) and from the local station, that will be a lot of auditing...
              I am asking myself if there's a way to get a notice when someone connects a USB pen...
              I tried ( on server ) to use audit but I did't find any option for "copying files" ( from server to station), only :
              - Full control
              - Traverse folder
              - List folder
              - Read Attributes
              - Read Exetended Atributes
              - Create Files
              ... and so on

              Also I don't know how to use audit on WindowsXP machine, to see if the files are copied on USB pens on not.

              Auditing will cover this scenario:
              " A file from network is opened or editing. Using the 'Save As..." command the users make a copy of this file on his computer ( or right to USB memory)?"


              Originally posted by Lior_S View Post
              There are third party utils
              or you can disable all USB ports
              or you can use XP SP2 and make them read only
              For the time disabling the USB ports is not wanted, unless there is a proof that data is taken out of company.

              Comment


              • #8
                Re: what files have been copied

                For this you would need to use a third party tool i'm afraid.

                Something like Securewave Device Control would work.

                Comment

                Working...
                X