We help IT Professionals succeed at work.

How to view history of file copying activity on a laptop?

Mad_Lenny asked
We have someone in our organisation who we suspect may have transferred a significant amount of company data from their company laptop onto a cd or USB key. Our HR people want to know what this was - is this possible? The laptop in question is XP with office 2003.

Watch Question


If you would have configured Object Access auditing in laptop before data was copied, you would have corresponding events in Security log. But copying files would be reported as Read operation and would not differ from actual reading of files. I believe that the answer is unfortunately - not possible.

Brian PiercePhotographer
Awarded 2007
Top Expert 2008
I agree with Toni - not possible. With standard windows accounting even if object access was enabled and the files/folder were configured for auditing there is no way of determining if the files were just opened or copied.


Hi Guys,

In that case then I guess we'll never know. Its never been a problem before....so I'm not sure what best practise is round this. HR seem to think that I should be omnipotent when it comes to any user activity, perhaps they are right, but how far do you go?

Anyways, many thanks for the speedy replies,

Toni UranjekConsultant/Trainer

Implement security restrictions for confidential data, if you don't trust people don't give them access to such data, or use 3rd party product like http://www.gfi.com/endpointsecurity/ to prevent copying data to external devices. But you should realize that malicious user can still send mail or even use xerox machine, to get information out of the office.

Explore More ContentExplore courses, solutions, and other research materials related to this topic.