0

A pendrive with some sensitive files were connected to a Windows XP computer. I'll have access to that computer, now it's turned off.

How can I analyze if some or all files from my pendrive were copied, moved or deleted? What kind of programs can I use, what files or clues can I have ? I don't know it log were enable in Windows XP.

woliveirajr
  • 4,462
  • 2
  • 17
  • 26
Lena Queen
  • 111
  • 1
  • 1
  • 1
    In short, unless this is a special flash device which does internal logging, or you have an audit log of system calls in the target computer, or there's a rootkit doing the same, **you don't**. The rule is: **if there are any data you don't want other people to see, don't give them the data in the first place**. – Deer Hunter Jun 05 '13 at 11:24
  • @DeerHunter: yes I know its my mistake. But any case to know/analyze If my file on flash drive has copy or not? Thank you – Lena Queen Jun 05 '13 at 11:27
  • No, you can't know if it has been copied; you can try searching through the filesystem on the target computer - if it is possible. Prepare for the worst case (your data have been compromised). – Deer Hunter Jun 05 '13 at 11:32
  • @DeerHunter: Oh dear , Its my big problem :( – Lena Queen Jun 05 '13 at 11:43

1 Answers1

1

There could be some more information in your question to help us answering it. Ideally, which Operating System (OS) you have (Windows? any Mac?).

And if I understood correctly, you have a pendrive (flash drive) with some sensitive / important files on it, and it's connected to a computer during some time. And you want to know if someone, using that computer, did copy, move, etc., files from or to the pendrive.

In general, you can't know. Just some OS have ability to create a log of this kind of activity. In those systems, you enable logging for all files access that is made, and then you can erad the log to see if something was read. I'm assuming that you are using Windows home-edition...

To avoid loosing information from your pendrive (someone deleting), the protection is to have a backup somewhere else.

To avoid having sensitive files read from it, the solution is to protect those files with some encryption, so that anyone who copies the file won't be able to read its contents. For example, you can password protect Word / OpenOffice files, you can zip your files using password protection, you can use Truecrypt to create a virtual protected drive inside your pendrive...

Give more details on what you need, and people will be able to give better ideas.

woliveirajr
  • 4,462
  • 2
  • 17
  • 26
  • The computer that my pendrive connect use windows xp. Oh deaar I have big problem. Anything software or anything trick to knowing the case? Thanks – Lena Queen Jun 05 '13 at 11:42
  • @LenaQueen : your pendrive can't tell you what was copyied to/from it. You could have any chance if you have access to the windows xp computer, and is able to analyze it. Can you ? – woliveirajr Jun 05 '13 at 11:46
  • Yes I can but now the computer is shut down maybe tomorrow I can access and analyze. How do that? – Lena Queen Jun 05 '13 at 11:48
  • in this question you have some hints: http://security.stackexchange.com/questions/23280/how-to-detect-if-files-were-saved-or-copied-to-a-usb-drive?rq=1 – woliveirajr Jun 05 '13 at 11:54
  • I edited your question to reflect what you told us and what you need to know... – woliveirajr Jun 05 '13 at 11:58
  • woliveirajr : Thanks for editing. Could you please give me the best advice to do that? how? Thanks – Lena Queen Jun 05 '13 at 22:26
  • @LenaQueen: yes, can give some hints. 1st: use the file names from your flash drive (the sensitive ones) and do a simple search in the computer. 2nd: what kind of file was that? If it were excel spreadsheets, opne excel and see the recent files, to see if it was opened there. Were images? open the image visualization program from the computer... 3rd: search for .lnk files, they are created when windows does some activities (like pre-visualizing the file content on windows explorer). Let me know what you`ve done, got... – woliveirajr Jun 06 '13 at 12:01
  • @LenaQueen had sucess ? – woliveirajr Jun 07 '13 at 18:35