Logging of USB devices?

  • Thread starter Thread starter T-Bar
  • Start date Start date
T

T-Bar

Follow-up to microsoft.public.win2000.security

Hello,

Is there a way to find out if a USB device has been attached to a computer
in the past and if data has been copied from this computer onto the device?
If yes, is there a way to find out if certain files or folders were copied
from the local harddrive (or network drive) to the device?

Cheers, T-Bar
 
T-Bar said:
Follow-up to microsoft.public.win2000.security
Click to expand...
Is there a way to find out if a USB device has been attached to a computer
in the past and if data has been copied from this computer onto the
Click to expand...
device?

I don't think so, not natively.
If yes, is there a way to find out if certain files or folders were copied
from the local harddrive (or network drive) to the device?
Click to expand...

I don't think so. NTFS file auditing is the native mechanism for doing
this, but if the USB device is not yours and is not under your control, you
have no way of controlling whether it is formatted in NTFS [if this is even
possible for the device in question] and whether auditing is enabled. You
can't easily enable auditing on the source files, because copying files is
indistinguisable from simply reading files.
 
T-Bar said:
Follow-up to microsoft.public.win2000.security

Hello,

Is there a way to find out if a USB device has been attached to a
computer in the past and if data has been copied from this computer
onto the device? If yes, is there a way to find out if certain files
or folders were copied from the local harddrive (or network drive) to
the device?

Cheers, T-Bar
Click to expand...

Hello

I think the connection of usb device should be logged in to Event Viewer.
Control Panel ->Administrative tools->Event viewer.
I don't know about how to monitor the file copied from the device though.
 
T-Bar said:
Follow-up to microsoft.public.win2000.security

Hello,

Is there a way to find out if a USB device has been attached to a computer
in the past and if data has been copied from this computer onto the device?
If yes, is there a way to find out if certain files or folders were copied
from the local harddrive (or network drive) to the device?

Cheers, T-Bar
Click to expand...

In most offices, USB is one of the biggest risks for data
theft by employees and visitors. And unless someone is
caught in the act of stealing the data there isn't much
you can do about it.

For future protection in your workplace, you might want
to investigate options such as disabling USB in the BIOS,
then password protecting access to the BIOS setup. If
that is not an option in your BIOS, then you might have
to consider physically disabling the ports.

In some systems - particularly older ones - physically
disabling the ports can be as simple as open the case
and disconnecting cables that run from ports on the
motherboard to the external ports. In some sytems
there are jumpers on the motherboard.

On newer systems you might have to resort to something
more extreme - such as permanently gluing an obstruction
into each port. I find that bulk USB connectors (such
as used for making your own cables) and a drop of
SuperGlue in each port works perfectly.

If disabling USB on all of your systems is not an option
for you, then you must strictly forbid employees and
visitors from bringing their own USB-capable devices to
your facilities. This includes MP3 players, most digital
cameras, many PDA's and some phones.

USB data theft needs to be addressed as part of a comprehensive
data security plan that also addresses many other issues, such
as the use of CD/DVD burners, devices attached to external SATA,
USB, or FireWire/IEEE1394 ports, wireless security, and so on.
 
Hi, the think you offered sounds me not so comfortable... There are tools
that easily & centrally controls users access and there is no need to do
something physically.
Try securewave sanctuary device control or GFI PSC...
atx.
 
The actual connection to the computer may be recorded in Event Viewer. You might have
to enable auditing of system events first. W2K allows enabling auditing of object
access that then allows you to audit folders. A copy is a read on source and write on
destination. You would have no way of knowing if a file was copied or not to an
external device. You could only tell if a user had accessed a file on the hard drive
and only if that folder had auditing enabled which they do not by default. --- Steve
 
Back
Top