Monitor all file system activity on a target server

Introduction

This file system watcher allows you to monitor all file system activity on a target server. This is particularly useful when you are working with an architecture that requires complex configuration modifications. By deploying this file system watcher you can keep a history of what files are created, modified and deleted and when these events occurred. You can also determine if any automated build processes are occurring on the target machine by recognizing regular binary drops, etc.

This simple solution was brought to you by the Chatbot! Cyber Community where humans and chatbots unite!

http://www.p2bconsortium.com/ - Person 2 Bot Consortium
http://www.chatbot.us/ - Chatbot! Personal Chatbot Server

Instructions to deploy

Step 1

Build \FileSysWatch\FileSysWatch.sln

Step 2

Copy \setupFileSysWatch\Debug\Setup.Exe to target server

Step 3

Remote-Desktop into target server. On Windows 2000: Start->Programs-> Accessories->Communications->Terminal Service Client

Step 4

Create directory structure: C:\SimpleSolutions\_fso_lg\ on target server

Step 5

Install \setupFileSysWatch\Debug\Setup.exe on target server

Step 6

At command prompt on target server type "net start filesyswatch"

Step 7

Periodically look at log file in C:\SimpleSolutions\_fso_lg\ on target server

Step 8

"Disconnect" from remote server do not "log off" and your FileSysWatch process will continue to monitor file system activity when you are logged off.

Deployment Model

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here