I'm looking to find a way to review either in real time or through history Windows explorer file movements on a Windows 10, 11 or server 2019 OS. I've been googling for a bit and I've only found Index.dat, but that seems like that is the history of internet traffic. If anyone has information on what processes or services are used to copy/paste, I think that would be a good way to track this.

Things I've thought about but can't seem to find are a library or method that reads the clipboard. That helps determine what is being copied, but not the source or destination, which I'd also like to track. I'm sure there are applications out there that do this kind of thing, but have had no luck finding them.

Thank you for your guidance.

  • I'm trying to review file copies and movement on a system --- Enable Auditing on Server (mainly) and Workstation. That is how to track.
    – John
    Sep 1, 2022 at 15:08
  • Thanks, but as I understand, that is very resource heavy. Is there any information out there that goes into detail on how to pull information from this system? Sep 2, 2022 at 16:44
  • 1
    You need to enable auditing but I do not recall it as being a resource pig. docs.microsoft.com/en-us/windows/security/threat-protection/…
    – John
    Sep 2, 2022 at 18:18


You must log in to answer this question.

Browse other questions tagged .