Keeping records of file copying operation

Question

5.00/5 (1 vote)

See more:

I want to know how to keep records of copied files to an external disk, such as USB? Does anyone know how to achieve this in coding? Which kind of API can be used to do this?

Thank you

Posted 15-May-10 21:00pm

petta1000

Updated 15-May-10 22:29pm

Moak

v2

Add a Solution

3 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Heinzzy · Answer 1 · 2010-05-15T22:56:00

Solution 2

I'd reccomend you to create a service whick use WMI to detect USB-drive connection and SystemFileWatcher to create a list of stealed files.

Posted 15-May-10 22:56pm

Heinzzy

«_Superman_» · Answer 2 · 2010-05-16T08:55:00

Solution 3

As daveauld said, this is not an easy task to achieve.
You will need to write a File System Filter Driver[^].

Posted 16-May-10 8:55am

«_Superman_»

DaveAuld · Answer 3 · 2010-05-15T22:27:00

There is no simple way to achieve this.

A copy operation is not a straight forward audited event on the file system, and therefore cannot be easily traced.

You would need to hook deep into the os to track file read and file write operations and work out what constitutes a copy.

I believe there are commercial auditing products available on the market, which i would suggest you investigate if you are looking for a reliable solutions.

Programmming one yourself is not something i would suggest you undertake.

To get an idea of what is going on you should download a FileMonitor from Sysinternals and watch what activity is going on at the file system level when things are being opened, copied, deleted etc. and you will see it is quite complex.