Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to find out which files are transferred to an external usb flash drive in certain period of time?

To be more clear. If I/someone have a flash drive and take some data from me. How do I know which files are copied? Finding out file copy hostory could be also a work around.

share|improve this question
+1: By the way, interesting and useful question. – Diogo May 17 '12 at 11:40
possible duplicate of How to monitor and report file copy activities in windows XP? – Moab May 17 '12 at 14:14
up vote 5 down vote accepted

The only kind of trace avaiable on Windows is the Windows Event, which could be accessed from the Windows Event Viewer, showed above:

enter image description here

Unfortunately, I couldn't find(I suspect that anyone would) any specific event related with your problem(unauthorized file copies to flash drives).

I am almost sure that you will not be able to find if someone already did a unauthorized file copy from your system but I could list two applications that would help to find if someone try the same thing in future:

DiskMon is an application that logs and displays all hard disk activity on a Windows system. You can also minimize DiskMon to your system tray where it acts as a disk light, presenting a green icon when there is disk-read activity and a red icon when there is disk-write activity.

This is a behavioral analysis tool of applications for the Win32 operating system family. Capture BAT is able to monitor the state of a system during the execution of applications and processing of documents, which provides an analyst with insights on how the software operates even if no source code is available. Capture BAT monitors state changes on a low kernel level and can easily be used across various Win32 operating system versions and configurations. CaptureBAT is developed and maintained by Christian Seifert of the NZ Chapter.

Additionally, I would reccomend you to use some kind of cryptografy on your disk to protect your files from this kind of problem. Take a look on Truecrypt software.

Hope this information helps you some way.

share|improve this answer

You must log in to answer this question.

protected by Community Nov 3 '15 at 17:26

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .