Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it possible to find out which files are transferred to an external usb flash drive in certain period of time?

To be more clear. If I/someone have a flash drive and take some data from me. How do I know which files are copied? Finding out file copy hostory could be also a work around.

share|improve this question
+1: By the way, interesting and useful question. –  Diogo May 17 '12 at 11:40
possible duplicate of How to monitor and report file copy activities in windows XP? –  Moab May 17 '12 at 14:14

2 Answers 2

up vote 4 down vote accepted

The only kind of trace avaiable on Windows is the Windows Event, which could be accessed from the Windows Event Viewer, showed above:

enter image description here

Unfortunately, I couldn't find(I suspect that anyone would) any specific event related with your problem(unauthorized file copies to flash drives).

I am almost sure that you will not be able to find if someone already did a unauthorized file copy from your system but I could list two applications that would help to find if someone try the same thing in future:

DiskMon is an application that logs and displays all hard disk activity on a Windows system. You can also minimize DiskMon to your system tray where it acts as a disk light, presenting a green icon when there is disk-read activity and a red icon when there is disk-write activity.

This is a behavioral analysis tool of applications for the Win32 operating system family. Capture BAT is able to monitor the state of a system during the execution of applications and processing of documents, which provides an analyst with insights on how the software operates even if no source code is available. Capture BAT monitors state changes on a low kernel level and can easily be used across various Win32 operating system versions and configurations. CaptureBAT is developed and maintained by Christian Seifert of the NZ Chapter.

Additionally, I would reccomend you to use some kind of cryptografy on your disk to protect your files from this kind of problem. Take a look on Truecrypt software.

Hope this information helps you some way.

share|improve this answer
As you point out Windows does log copying of a file, which one might understand, based on the fact you copy and delete hundreds of files daily. This doesn't mean that it cannot be logged by third-party programs. –  Ramhound May 17 '12 at 13:22

For a similar issue at work, we used USB Security which logs any activity on USB drives. But, the problem is that you can see events that happen after you install it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.