Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Everything that I know about programming tells me that this isn't a trivial task, but is there a way to track if something has been copied off a computer to an external drive? All I can find in Windows 7 is "Audit object access" which doesn't appear to differentiate between copying and reading ( and I understand that a copy is basically a read operation with a parallel write operation ).

So is there something that I'm missing or is this not possible without third party software?

share|improve this question

You're not missing anything. A copy is a read operation.

share|improve this answer

We did our own research before on this topic working our own software for file server auditing and it could not find any ways to implement this feature. But it was asked frequently by our customers. Yes, just because copy is technically a read then write operation the only way to monitor it is to monitor both reads from the source and writes to the destination and then try to correlate it.

share|improve this answer

Some AntiVirus applications will log files written to an external device. A similar approach might be a better way to look at the problem.

share|improve this answer

If the copy is written to the file system, as opposed to written to memory, there will be corresponding event log entries. However, you can't expect a single clear entry to tell you what happened. e.g. A delete is actually three separate operations as far as the logging goes. I'm not sure how many distinct operations a copy will be but I'd expect no less than six. If any of the operations wasn't logged then the copy operation was probably not successful. I suggest you ask on Stack Overflow, as the coding aspect of this is a bit outside the scope of this site.

share|improve this answer
No I'm asking about the admin aspect of it. I mentioned programming just because, well, that's the way I try to think of everything i.e "how would this be implemented in code anyway?" – Paranoid guy Jan 21 '11 at 13:08
@Paranoid, it's all there in the event logs but it's anything but easy to find or interpret. That's why I would only do this programmatically. – John Gardeniers Jan 23 '11 at 22:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.