[Tech] Any way to tell if a file has been copied to a USB stick?

Pages : [1] 2 3

NAT Mav
07-10-2009, 10:19 AM
Got a strange request from a co-worker wanting to know if a file had been copied off of his PC to a USB stick. Anyone know of a way to detect this after the fact?

Phydeaux
07-10-2009, 10:22 AM
Is this some sort of trick question?
Open the USB drive and look.

DVADER
07-10-2009, 10:23 AM
plug usb stick in and see if the file is on it.

soundjester
07-10-2009, 10:24 AM
put the USB stick through an xray machine. That should tell you.

Rooster!
07-10-2009, 10:24 AM
I think his point is someone that took the file has the USB stick, he's asking on the PC side of things not the other way around.

soundjester
07-10-2009, 10:26 AM
so basically -
you want to see if a file has been copied from the local machine to some other place without having access to the that "other place?"

dweeb
07-10-2009, 10:27 AM
:lol: first 3 replies

I don't think someone would even be able to sign on to TW if they didn't know that.

I'm confident Rooster! read the question correctly.

dweeb
07-10-2009, 10:27 AM
Yea, is there any way to know if someone stole a file off your computer via USB stick?

NAT Mav
07-10-2009, 10:29 AM
Yea, is there any way to know if someone stole a file off your computer via USB stick?

Yeah, in a nutshell, that is the question.

Detox.enD
07-10-2009, 10:29 AM
....
files retain the last time they were accessed, you can look at that. but if it was accessed after you suspect him of using the USB that wont help you - and is probably the case. Even then, it wont confirm he copied it anywhere.
...

but i will tell you you can lock the ability to do so in the future via group policy quite easily...

dweeb
07-10-2009, 10:30 AM
You really have to break it down to the simplest form for some of these guys

cyclozine
07-10-2009, 10:31 AM
you can check the last access time for the file, but it'll be useless if your coworker has already accessed the file after the suspected copying

edit: nevermind beaten

Baby Bew
07-10-2009, 10:31 AM
Check the USB port for signs of forced entry.

Detox.enD
07-10-2009, 10:32 AM
index or log of copied files on WinXP system?? (http://forum.soft32.com/win3/index-log-copied-files-WinXP-system-ftopict52880.html)

any chance your IT guy (you?) set this up?

MME
07-10-2009, 10:32 AM
only if they changed it tooso you could see the date last modified by leaving a notepad document saying that they had taken the file and copied it to their thumb drive

(i have no idea)

DVADER
07-10-2009, 10:32 AM
You really have to break it down to the simplest form for some of these guys

Ask a stupid question, get a stupid answer.

Detox.enD
07-10-2009, 10:33 AM
only if they changed it too you so could see the date last modified by leaving a notepad document saying that they had taken the file and copied it to their thumb drive

(i have no idea)

you don't have to modify it... files have creation, modified, and access time stamps on them.

Animo
07-10-2009, 10:36 AM
Check the USB port for signs of forced entry.

Also check for stray hairs, fingerprints, or bodily fluids near the USB port. This can help to identify the perp.

Phydeaux
07-10-2009, 10:39 AM
Depending on which OS he's using the procedure may differ slightly:

Right-click the folder that the file is in, click views>details.
Right-click the folder again, click "sort by" and check the "date accessed" box to see when the file was last accessed.
If it's more recent than the last time he accessed the file, it would imply that someone else has handled the file.

Tell your alleged co-worker to quit storing his porn on a shared computer.

NAT Mav
07-10-2009, 10:39 AM
but i will tell you you can lock the ability to do so in the future via group policy quite easily...

Yep. Too bad they won't let us.