Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to know when a image file is modified by a User or a Windows Session and also the name of User/Session.

How to do it?

share|improve this question

You might use the file system auditing features to log all kind of access on a specific file or directory. Just follow this short howto to enable auditing on the file(s) in question and evaluate the security logs.

If you haven't activated the logging yet but need the information for past changes, you might be lucky to find it in the NTFS journal. The journal would rotate every now and then (depending on the amount of change operations on your disk and the configured journal size), if the change has already been overwritten, then there is no way to get to it anymore.

There is a sample journal reading application with source code distributed by Microsoft - some small changes should be able to produce the changing user's SID. There might be free utilities for reading the journal giving you the SID or the user's name as well.

share|improve this answer
Oh yes thanks. But I want to know if the file is modified before enabling Enabling File and Folder Auditing.? – Zakaria Jul 8 '11 at 9:30
try the NTFS journal - I've updated the answer with relevant info – the-wabbit Jul 8 '11 at 21:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.