Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a small office network with about 20 computers. How can I track what files and which computer is either sending or receiving files?

My question is not how to prevent someone from sending files, but to track who and what files they are sending and receiving outside of the network. The files could be send through messenger, email etc.

share|improve this question
It would help to give more information on your network setup – Journeyman Geek Jan 11 '12 at 11:52
If you want to monitor every possible method of a file transferring out of your network, you will need to be more specific than "etc" – Paul Jan 11 '12 at 11:54
I have updated my answer - it has detail on prevention as I misread your it also has a wee bit on logging. – Rory Alsop Jan 11 '12 at 17:18
up vote 1 down vote accepted

Difficult to do in the network.

  • Data sent may not always have a "filename" attached to it.
  • Data can be encrypted (e.g. HTTPS).
  • Protocols may be unclear (Common use of Port 80 by protocols other than HTTP).

Difficult to do on the PC.

  • People can install own programs
  • People can use "official" programs in unexpected ways.
  • People can boot from USB-flash drives
share|improve this answer

As indicated in the previous answer it is technically difficult and actually impossible to block even the most obvious ways without obstructing fair usage.

Legally, it might be also tricky not to violate privacy laws.

Your best shot is to trust the users. And if you do not trust some - limit their access to the sensitive files.

share|improve this answer
As my question stated, I do not intent to "prevent" / or block file transfer, but to log them. – KMC Jan 12 '12 at 0:56

There are DLP (Data Loss Prevention) products like InfoWatch Traffic Monitor that claim to do what you're asking. However, all these products are not off-the-shelf turn-key solutions, but rather complex systems that require consultants to be installed, tuned, etc. They use complex traffic analysis algorithms to detect data leaks (OCR image attachments, scan encrypted traffic, can detect suspicious activity, etc.).

They cost lots of money. I'm not aware of any such system that would be cost-effective for such a small company (20 users).

share|improve this answer

There are some basic off-the-shelf solutions (eg Macafee's offering) that can work as a drop in on basic role based access rules, but to gain any value you will need to tune/configure any DLP solution.

What some organisations I work with do is define permissions by user (eg only these 3 individuals are allowed to send attachments out, only those ones can print etc). For this scenario you place your trust in those named users. If they make a mistake, or turn rogue you can still check the logs to see what they sent, but data can leak. At least you have reduced the risk down to just those individuals (or anyone with their credentials)

What others do is attach code words to all key documents, and set the DLP service to trigger on them. Standard mail gateways may have this functionality (I know Mailsweeper and the like do)

A more mature solution is to enforce classifications on all documents - this may be overkill for you just now, but you are at a size where it is manageable, and will become ever more useful as you grow. Using classifications it becomes very easy to deny outgoing secret or internal docs while allowing lower sensitivity ones.

To stay closer to your exact question, all of the above options will log what is sent out - the most appropriate for you if you aren't needing to block may just be to enable logging of all mails sent with attachments at your mail gateway (eg Exchange...)

share|improve this answer

If you have linux systems you can use the linux kernel auditing to log all the file accesses read/write. From this you can get the user, process-id and executable name that accessed the file.

You can use aureport to generate a report.

In the report you can look for executables like chat clients,browser,ssh client etc. to find what files were accessed by them (possibly for sending)

Note:You have to install the "auditd" package for this.

This is a good place to start.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.