Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1855
  • Last Modified:

How can I see if a file has been copied to an external device?

One of our users left the company. His manager suspects that he gave some confidential files to our business rival. He wants me to check the laptop for files that have been copied to an external device.
Is there any way to do this?
Thanks.
0
elkep
Asked:
elkep
  • 4
  • 4
  • 2
  • +2
3 Solutions
 
Chris JamesCommented:
Check the creation/modification/access date on the files that may have been copied by going into the file properties.
0
 
rpggamergirlCommented:
When you're viewing files in explorer, view > details, it will give you the date when the file was last modified.

0
 
rpggamergirlCommented:
Sorry, for the duplication, ignore my post.
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
elkepAuthor Commented:
I could do that but that is no proof. And also, there are lots of files.
0
 
Chris JamesCommented:
Why isn't it proof?  it clearly shows the times on the timestamp.

What you can do is CD into the directory through CMD

and do a DIR listing on the contents of the directory and send the output to a file.


ex..

dir > C:\file.txt

If you go to CMD and type DIR /? it will give you a list of switches and options you can use to filter out specific information such as creation date, ex... /T  (time field)    C is for Creation, A is for last Accessed, and W is for last written.

Hope this helps.
0
 
rpggamergirlCommented:
>>> And also, there are lots of files.<<<

When viewing them via file properties you can only see each file, but in explorer, when you rightclick anywhere on the right pane and click View > Details, and you can see all the files and their 'last modified' dates in one page.
0
 
MikeKaneCommented:
The modify date of the file is not proof the file was copied.  For all he knows, the file was opened, a comma was added, then saved back to the original file name.  

I don't think you can get this type of historical info unless you had a process in place to monitor the file usage already.  

0
 
rpggamergirlCommented:
No, not a proof of course.
I don't know if there's anyway to prove that a file has been copied.
0
 
Danny ChildIT ManagerCommented:
We have some software in use called Sanctuary, which used to be from SecureWave, who have become Lumension
http://www.lumension.com
 - it blocks access to all removable media - USB, Floppy, CD, fitting a 2nd hard disk, scanners, iPods, , mobiles, PDAs, the works.

Perhaps this is a case in point for your organisation to consider using it....

Of course, you'll also need to block access to Hotmail and other file-sharing sites too.  And keep some solid logs of (supposedly legitimate) email traffic too.
0
 
Chris JamesCommented:
rpggamergirl:  there is proof, ever hear of a honey pot before? They run software that monitors hard disk activity and file activity, etc.

It is possible.
0
 
MikeKaneCommented:
Like I said, It is possible, but it requires a solution setup up before the incident.  You can't go back to pull historicals with a 3rd party prior to the date the 3rd party was installed.  

Unless you have this setup already,  I don't see a way to get this info now.


0
 
Chris JamesCommented:
MikeKane:  Yea, that's 100% true.
0
 
elkepAuthor Commented:
Thank you all for your answers. Indeed, you need a 3rd party software already installed if you want to prove anything. Maybe the Sanctuary Software is an option here.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

  • 4
  • 4
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now