[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

USB (who dragged what and when)

Posted on 2011-05-12
8
Medium Priority
?
398 Views
Last Modified: 2012-05-11
Is there any way of windows XP machine to see a history of the last 3 months USB activity, i.e. who plugged in what USB, what date/time - and what files were dragged to and from the USB?
How can you map what ever audit logs are found on the USB back to the actual device, does each USB have a unique ID for example, or are the same models the same ID?
0
Comment
Question by:pma111
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 1

Accepted Solution

by:
Xperta earned 700 total points
ID: 35745198
0
 
LVL 70

Assisted Solution

by:KCTS
KCTS earned 600 total points
ID: 35745200
The short answer is no
Even if Auditing was switched on, it could only tell you who accessed the file, and if it was not on then you won't even get that.
0
 
LVL 5

Assisted Solution

by:jarrod_williams
jarrod_williams earned 700 total points
ID: 35745265
NO, their is no way you will be able to view who did it, unless you have a software that is able to do such.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 3

Author Comment

by:pma111
ID: 35745306
How can you tell what auditing is switched on on the local machine?
I assume it isnt by default.
0
 
LVL 5

Expert Comment

by:jarrod_williams
ID: 35745326
Here is a step by step guide to see:

http://www.windowsecurity.com/eventlogscan/auditing.htm
0
 
LVL 5

Expert Comment

by:jarrod_williams
ID: 35746227
Did that help you?

PLease get back to us.

Thanks
0
 
LVL 3

Author Comment

by:pma111
ID: 35746253
I rung one of the local forensics setups who said there are hidden files on the machine called lnk files which may give some clues as to files opened/viewed from the USB.

Auditing was no luck but the USB plugin tool looked useful.

Its a shame really that without expensive DLP tools you cant see what is/was being dragged out of the company, I hate USB they should be outlawed
0
 
LVL 70

Expert Comment

by:KCTS
ID: 35746323
IRM (information Rights Management) may help http://technet.microsoft.com/en-us/library/cc179103.aspx
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Windows 10 Creator Update has just been released and I have it working very well on my laptop. Read below for issues, fixes and ideas.
The article covers five tools all IT professionals should know about, as they up productivity by a great deal!
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decadeā€¦
Suggested Courses

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question