How can I monitor and report file copy activities in Windows XP?

Question

I have some developer machines that part-time developers come and work on. I want to monitor and report if they copy any files to external media or attach files to their email accounts (and so on).

It is a matter of source protection, but I cannot disable internet access or external media, so is there any way to log these kind of file actions in Windows XP?

Answer 1

You might want to consider physically securing their workstations. Configure their workstations without WiFi or Bluetooth or user-accessible USB ports, put the computers in enclosures which allow airflow but which block access to the ports on the back (such as the Ethernet port and USB ports), block or limit their Internet access, and don't allow them to connect personal devices to the network. Of course, if someone is determined enough to steal code, this won't stop them, but it will make things significantly more inconvenient.

Unless you're producing software for banking or weapons systems, you might just be overly paranoid. Run background checks on all your employees, or at least require them to provide enough information so that you can run the background checks at any time. Also make sure you have them all sign nondisclosure agreements and have well-defined entrance and termination procedures, such as signing a paper saying that they have returned all company property and have returned or destroyed all copies of your code which have come into their possession. This might not prevent them from stealing code, but it gives you some legal recourse if your code ends up leaking out and the leak can be traced back to a specific employee.

At some level you need to be able to trust the employees you hire, or else you're just wasting your money.

Answer 2

I think "process monitor" by sysinternals may be able to help in that regard.

Answer 3

You can also try diskmon.

http://technet.microsoft.com/en-us/sysinternals/bb896646.aspx

Answer 4

You could use captureBAT and exclude all other activity from being reported in the log files. http://www.honeynet.org/project/CaptureBAT This allows you to monitor file system changes, among other things.