Hi All,
I have some questions regarding files residing on a thumbdrive.
1)There is a executable file residing on the thumbdrive and has been accessed several times, I know the file's properties will show the last accessed date. Is there any way to check the previous dates that has been accessed?
2) Is there any way to check if the file has been transferred out of the thumbdrive?
Thanks.
Regards
Just out of curiosity, with just the thumb drive, how would propose to do either?
1)There is a executable file residing on the thumbdrive and has been accessed several times, I know the file's properties will show the last accessed date. Is there any way to check the previous dates that has been accessed?
In theory, yes. On a suitably configured Windows system, for instance, you may find records of file access in the security log. On other operating systems, there may be other ways.
Or, if that thumbdrive has a transactional file system, you may find updates of last access date in the transaction log. (No, not very likely, is it.)
In practice, however, you won't see that kind of logging enabled, except in very special cases (at least as far as Windows event logs is concerned).
FAT32 on the thumb drive?
Hi All,
Yes, it is FAT32.
I guess I will need access to suspected PCs?
Regards
I guess I will need access to suspected PCs?
To tell you more than what you already know, yes. With the PC, you may be able to use LNK file, restore point, prefetch and registry data to get more information on the executable.
Without it, probably not.