Ideally, I'm looking for a FOSS tool that will tell me if someone copied files from a USB stick.
Here is the scenario…
Assume you give someone a memory stick that has files on it. You give them the memory stick so that they can copy files that presently on their computer onto the memory stick.
Assume that what they actually do is copy files from the memory stick onto their computer.
Is there any way that you can tell (using open source tools) – by just looking at the memory stick and its files – that the files on the memory stick were copied? When they were copied? Assume that you don’t have their computer to verify whether or not they copied the files.
Reason through it…how would you do that? What would you look for, with respect to the files, to determine this?
hello scubaduba,
i think the only trail that copying would leave is setting the last accessed time to current time, but keep in mind that this also happen by just opening it, showing its properties (on windows), or scanning it by antivirus.
cheers
