asked on

USB (who dragged what and when)

Is there any way of windows XP machine to see a history of the last 3 months USB activity, i.e. who plugged in what USB, what date/time - and what files were dragged to and from the USB?
How can you map what ever audit logs are found on the USB back to the actual device, does each USB have a unique ID for example, or are the same models the same ID?

ASKER CERTIFIED SOLUTION

Xperta

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

Brian Pierce

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

jarrod_williams

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Pau Lo

ASKER

How can you tell what auditing is switched on on the local machine?
I assume it isnt by default.

jarrod_williams

Here is a step by step guide to see:

http://www.windowsecurity.com/eventlogscan/auditing.htm

jarrod_williams

Did that help you?

PLease get back to us.

Thanks

Pau Lo

ASKER

I rung one of the local forensics setups who said there are hidden files on the machine called lnk files which may give some clues as to files opened/viewed from the USB.

Auditing was no luck but the USB plugin tool looked useful.

Its a shame really that without expensive DLP tools you cant see what is/was being dragged out of the company, I hate USB they should be outlawed

Brian Pierce

IRM (information Rights Management) may help http://technet.microsoft.com/en-us/library/cc179103.aspx