Hi,
I know, in Windows 7/10, when files are copied to a USB/external hard drive and one of those files is accessed, it creates a lnk file on the hard drive, which could help detect file copy.
Are there similar lnk files formed in ubuntu, when a file is accessed on a usb flash drive/external hard drive?
Or is there any other mechanism on ubuntu that serves as evidence when files are copied to external hard drive/usb flash drive?
Thanks
Tom
I did have some luck with the file '.recently-used.xbel'. To be able to view in a Windows environment meant copying out text and saving as xml. The file contained the path and added/modified/visited time and date vales. I'm sure there are better ways.
Tom,
Have a look at GVFS metadata, as long as the file was accessed by software that uses the metadata system (most GNOME software) then it may be recorded
https://
There is source code at then end on github to decode the data files, but if you are struggling let me know.