Find whether a file is copied to USB

[nepzraaz]

Hello Monks I am trying to implement the idea to detect whether a file is copied to a USB device or not. I have been googling through a lot of stuffs but couldn't find anything worth. I am looking for some tips on this one. I tried to use .lnk file bu the problem is that .lnk is only created when the file is opened and not if file is just copied.

[BrowserUk]

I am trying to implement the idea to detect whether a file is copied to a USB device or not.

Do you mean:

• a particular file; or any file?
• is copied to a particular USB device; or any USB device?
• within a few seconds after you hope it will have been copied to the device; or at any point during the day (week, month, ...)?

[nepzraaz]

I am sorry I posted it without much information . My idea is to find if any files from some sensitive directory is copied to some USB devices.

[shantanu_bhadoria]

Plus one for above clarification!

[pvaldes]

I am trying to implement the idea to detect whether a file is copied to a USB device or not

if (-e $myfile) {print "I got it!!!"};

... or

unless (-e $myfile) {print "Hey!, What have you done with my file?"}

[TJPride]

I'm guessing you're trying to prevent data theft, which I'm afraid is next to impossible. This is from a post someone else made on different forum:

For the USB devices, no. Your option there, and how companies with security needs of that magnitude deal with that issue, is to tightly lock down the clients and disable USB key use. (as well as CD burners, floppy drives if you still have those, etc) Again, that's going to require intrusive software, something like Landesk, + removing local admin so users can't take the software off.

[ww]

backticks and (OS dependant) ls or dir ?

[Anonymous Monk]

Hi,

Do you mean that you want to be alerted if someone is copying a file to a USB stick?

J.C.

[nepzraaz]

Hello Anonymous exactly, I want to generate an alert if someone copies some file from sensitive folder to a USB device. Any idea/hint will be very much appreciated.

[BrowserUk]

I want to generate an alert if someone copies some file from sensitive folder to a USB device.

There is no way to do this by monitoring!

It would be the work of seconds to defeat any attempt to monitor what files are being copied onto a USB device.

First, they could simply change the name. So then you'd need to (say) MD5 every file you find on EVERY USB device and check it against a list of known MD5 signatures. So then all they need to do is zip it; or encrypt it; or add a few byte to the front or the end of it; or just write it to the device reversed.

Reading between the lines you appear to be trying to impose or regulate some security directives. The proper way to tackle the issue is using your OSs security mechanisms.

I'm going to assume (based on your mention of .lnk files) that you are using Windows. In which case the correct mechanism to use is ACLs.

You (for example) could to define a group policy that PERMITs access to the "sensitive folder", and also DENYs access to all USB (or all removable) devices. When someone needs access to the sensitive data, you make them a member of that group. They can see the required data, but can no longer get access to USB devices.

Equivalent mechanisms are probably available for other OSs, but that is beyond my knowledge.