Track files and folders manipulation in Windows

Pieces0310 · 2015-10-31T13:01:20Z

The scenario is about Business Secret and our clients do worry about data leakage. They want to know whether Suspect copied those data to external hard drive or not. In fact it is not easy for Forensic guys to answer this question. Of course if you copy data from local drive to external drive and then access those files in external drive, there will be some LNK files created.But if you only copy files and folders from local drive to external drive in Windows, you could not find any "Copy artifacts" in log files or registry…So how do we know if Suspect copied files and folders to external drive or not? As I know that the only way to do this is to monitor and record files and folders manipulation, and you could take a look at logs to see what's going on.Let me show you how to do it. You guys could take a look at my blog as belowhttp//www.cnblogs.com/pieces0310/p/4925782.html