Evidence of file copy to external device on Windows 2000 / FAT 32

Discussion in 'Computer Security' started by Stefan Schiffer, Apr 19, 2006.

  1. Does a Windows 2000 user leave any traces when he copies a file to an
    external device (usb stick, usb harddisk, cd burner etc)? The source
    file system is FAT 32, so auditing file access by turning on
    appropriate event logging is not possible (see
    http://www.cert.org/security-improvement/implementations/i028.03.html).
    The suspect target devices are not available.

    I found device interface arrival/removal notifications (event ids 134
    and 135) for usb sticks in the event log, entries in index.dat files,
    that certain files were opened from an usb-stick, corresponding entries
    in the recent-lists but none of these records proof that files have
    been copied to an external device.

    Any hints where to search further?

    Thank you for your answers
    Stefan Schiffer
     
    Stefan Schiffer, Apr 19, 2006
    #1
    1. Advertising

  2. Stefan Schiffer

    donnie Guest

    On 19 Apr 2006 01:05:42 -0700, "Stefan Schiffer" <>
    wrote:

    >Does a Windows 2000 user leave any traces when he copies a file to an
    >external device (usb stick, usb harddisk, cd burner etc)?

    ########################################
    I just installed a 40GB USB drive on win 2000 and I copied some files
    to the drive. I can't find anything that shows that those files were
    copied. I'm surprised that you found as much as you did.
     
    donnie, Apr 21, 2006
    #2
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. kalyan chakravarthy

    what is Fat(File allocation table)

    kalyan chakravarthy, Jan 8, 2004, in forum: MCSE
    Replies:
    4
    Views:
    596
    Papyna.BO
    Jan 10, 2004
  2. -
    Replies:
    2
    Views:
    2,425
  3. *****General

    how to convert file system FAT 32 to...

    *****General, Oct 31, 2004, in forum: Computer Support
    Replies:
    5
    Views:
    5,243
    Ron Martell
    Oct 31, 2004
  4. Peter

    Re: Fat lenses can be fat targets

    Peter, Jul 3, 2010, in forum: Digital Photography
    Replies:
    12
    Views:
    595
    David Kerber
    Aug 10, 2010
  5. Robert Coe

    Re: Fat lenses can be fat targets

    Robert Coe, Jul 4, 2010, in forum: Digital Photography
    Replies:
    4
    Views:
    450
    John McWilliams
    Jul 4, 2010
Loading...

Share This Page