PDA

View Full Version : Auditing copied files



Pacifier
14-11-2005, 02:10 PM
Howdy,

I am trying to find out what files were copied off a USB drive to another USB drive on a particular machine. The machine is XP Pro, I am slowly coming to the conclusion it can't be done unless you have some auditing software installed. But I am hoping there is a way, I really need to know what files were copied.

Cheers

Graham L
14-11-2005, 03:11 PM
Get hold of the "another USB drive", and get a directory listing of it. :D

Sorry, that's the easiest way which is guaranteed to work.

You might be able to get the "last access date" of the files, which could be an indication. Does the Windows "Properties" include last access date?

Otherwise, XCOPY is a an MSDOS command which has an option for last access date ("/FA"), but that might not be the safest way to see that date.

There is a free programme called "xdir" which appears to support it (try "xdir last access date" to Google (google.co.nz)).

Graham L
15-11-2005, 04:05 PM
It appears that the "Properties" date accessed is updated before it's displayed. So it's a destructive and useless method. ;)