Tracking or auditing file copy

Question

Everything that I know about programming tells me that this isn't a trivial task, but is there a way to track if something has been copied off a computer to an external drive? All I can find in Windows 7 is "Audit object access" which doesn't appear to differentiate between copying and reading ( and I understand that a copy is basically a read operation with a parallel write operation ).

So is there something that I'm missing or is this not possible without third party software?

Answer 1

You're not missing anything. A copy is a read operation.

Answer 2

Some AntiVirus applications will log files written to an external device. A similar approach might be a better way to look at the problem.

Answer 3

If the copy is written to the file system, as opposed to written to memory, there will be corresponding event log entries. However, you can't expect a single clear entry to tell you what happened. e.g. A delete is actually three separate operations as far as the logging goes. I'm not sure how many distinct operations a copy will be but I'd expect no less than six. If any of the operations wasn't logged then the copy operation was probably not successful. I suggest you ask on Stack Overflow, as the coding aspect of this is a bit outside the scope of this site.