0

I was wondering if uploading data from system disk onto a file sharing online service, but it seems like the system logs these and they could be traced by the cookies of that website.

Is it the same if you were to copy from a system disk onto a portable disk? I have a hard time thinking that the system logs every file that's read from disk? I imagine it will be evident a device was plugged nothing else to show what was copied, etc.

Is there a bulletproof way to achieve this where if anyone were to inspect the system, they wouldn't be able to verify that some files were copied?

EDIT: Some of the methods that trace the act of copying files:

https://www.youtube.com/watch?v=NG9Cg_vBKOg

Improve this question
2
  • Access logs such as what you are thinking are often not enabled by default. If you are copying information from business that does have those enabled, then yes some access logs or copy log may be present, but only if the system is set to log them.
    – Darius
    Jan 20, 2014 at 4:29
  • If the logs are enabled what you want is difficult since your unlikely going to have the ability to delete the logs. I don't feel comfortable providing solutions.
    – Ramhound
    Jan 20, 2014 at 4:47

3 Answers 3

Reset to default
2

Which logs were you looking at specifically?

Some filesystems log the last accessed time, however this can be avoided (e.g. for Windows see http://msdn.microsoft.com/en-us/library/ms724933.aspx and the lpLastAccessTime field), and for frequently accessed data doesn't matter much anyway.

As for cookies, to upload files a cookie is not actually needed (its just the implementation of the actual service in question), and even if a cookie is needed, you can clear them from a web-browser, or not even use a web-browser on the system. Of course you cant hide the network traffic entirely, a TLS connection on port 443 that sends a large amount of data still looks like an upload rather than normal web traffic, even though the encryption prevents networking devices to know what it was (at least short of some questionable things Ive seen, like essentially setting up a man in the middle attack and making all the systems trust a wild-card cert so they don't warn the users), just what the end points of that connection were.

However in environments where people are intentionally protecting files, full access logging is of course a possibility, and by its nature can not be subverted (at least not by a non-root user that can interfere with the system configuration, or use some more indirect methods of file access).

Also On-Access virus scanners may keep a log of everything they scanned, even if its clean, and not sure if they would note if the access was to copy to a portable device.

Of course if you have physical access to the system, the problem becomes very easy. Since you can boot the system into another OS (e.g. Linux on a CD or USB), or connect the hard-disk to another system (I have never tried to bypass BIOS protection, but believe it is possible to prevent the boot to another OS without a password). However the fact you rebooted the system would be known. Another protection against this is encryption the files on the disk (or even the entire disk).

Improve this answer
1
  • Windows Event Manager, etc. I added a video where the guy explains how they catch people so all kinds of logs, cookies, etc are working in favor of them.
    – Joan Venge
    Jan 20, 2014 at 1:25
1

Windows has an auditing capability that can log each file access on specific drives or directories, possibly everything. This is not enabled by default. Some corporate environments don't enable this because it impacts performance.

USB mass storage devices are recorded somewhere when they are first connected - Belarc Advisor is a utility that can retrieve and report on this information.

The bulletproof way to do this is boot off of a live Linux CD of some sort and perform the copy without the underlying operating system involved at all. Ideally you would mount the partition read only to be very sure nothing on the volume is modified.

Improve this answer
5
  • IIRC its in the registry, and/or due to the drivers installed when the device is plugged in. I could swear it also stores the device ID of the device somewhere. I'll need to check my books to be sure.
    – Journeyman Geek ♦
    Jan 20, 2014 at 0:29
  • I never used linux. Do I have to install it? Because there is only 1 disk and say I am not able to open the PC case, would it work? Also why linux? Can other small apps possibly do this?
    – Joan Venge
    Jan 20, 2014 at 1:27
  • 1
    To absolutely leave no trace, the easiest and best way to guarantee you don't is to not have the operating system running at all. If you boot into another OS via a live CD or USB, you can then mount the drive, copy files, and no trace would be left. Any apps you run in the OS while it is running may have a chance of leaving some evidence, even if it's just a "Most Recently Used" entry in the registry or something. Recent Ubuntu and Debian live CDs support NTFS and that's why I mentioned it. A Windows PE boot disc would work OK as well, but it may update access times on the volume.
    – LawrenceC
    Jan 20, 2014 at 4:37
  • Furthermore ... a live CD runs entirely in RAM and doesn't affect the underlying HD at all by itself. This is assuming the BIOS will let you boot another OS from an external medium.
    – LawrenceC
    Jan 20, 2014 at 4:39
  • Thanks would a linux boot CD see another HDD plugged into USB? If so that seems like the best option. I just don't know if the linux boot CD is complicated to use. I think the system allows booting into another OS if you have a windows CD.
    – Joan Venge
    Jan 20, 2014 at 6:55
0

I have seen enough people like you ask this question about absolute privacy or security that I took time one day to write this blog on the subject.

The short answer is that no there is no bullet proof anything when it comes to these issues, because it all depends on other factors, like what you are hiding and from whom, and how much they want to get at it.

It is now possible for you to be monitored in ways that would amaze you. Take a look at this.

Improve this answer
3
  • Its really best to actually answer the question in your answer, linking to your own blog post is fine, but the answer needs to stand by itself.
    – Ramhound
    Jan 20, 2014 at 4:47
  • @rh, I'm not sure what you are getting at. People, even well reputed people, here link to other pages often. I wrote the blog because the answer is not simple, like most blog answers that try to get at the details of a question that does not have a simple answer. If all that is here is full answers, then I think we will dumb down what transpires here. my 2c.
    – Elliptical view
    Jan 20, 2014 at 5:22
  • Summarize the blog post. People might link to websites but the answer stands by itself in the case the website no longer works. Until I don't have to read the blog post to understand what your answer is my downvote remains.
    – Ramhound
    Jan 20, 2014 at 15:29

Not the answer you're looking for? Browse other questions tagged .