I am working on windows server 2012 R2. now I have the following case:-

  1. Inside IIS I have a .dll file named project.dll .created on 1/1/2016 , last modified on 1/7/2016.
  2. I took a copy of this file. save it inside a secure place
  3. now I wanted to test a new version of this .dll file. so I copy/paste an updated version of the project.dll file from our test server to our pre-live server. where I specify to replace the current .dll.
  4. so now the updated .dll have the following info. created on 1/1/2016 & last modified on 1/11/2016.
  5. now after the test . I realize that there are some errors, so I want to return the old .dll
  6. so I copy the .dll from the secure place, and paste it inside IIS related folder. and I chose to replace the current file.

now my question is how I can know when the operation on point number 6 occurred? as the .dll will have the original info; created on 1/1/2016 & modified on 1/7/2016. but I need to know when exactly operation 6 happen. in other words when the updated .dll was replaced by the original .dll ? as I need to check some logs to see if the errors were removed at the time the updated .dll file was no longer in place..


Just a couple of possibilities...

You can check the USN journal. (The Powershell module Powerforensics has a good cmdlet for this, Get-ForensicUsnJrnl. Every time a file is touched on an NTFS volume, there'll be a record of it in that journal.)

Or you could use a .NET file system watcher.

There are other possibilities but there are a couple to get you started.

  • can you please mentione how I can use the Get-ForensicUsnJrnl to check my dll file? – John John Nov 29 '16 at 13:13
  1. To monitor a file for changes, you could use tripwire or its open source counterpart OSSSEC. This only watches and alerts in the event the file is changed and no longer matches the 'baseline'.
  2. You could add the file into a Revision control system like subversion or git. This will allow you to maintain a collection of files and revert back to older versions in case your test case does not work.
  3. Puppet, puppet may be overkill just for ensuring a DLL file matches your 'good' version, but it allows you to define a source file that you want to exist in its current form on other servers. If the DLL file changes on the remote server, puppet will compare the MD5 hashes and see the change, then replace it with the version that 'good' version. When you are happy with the new version, you replace the file on the puppet server and puppet will happily deploy it to your remote server.
  • Thanks for the reply.. I am asking about my current file,, maybe in the future I will consider having a specialized tool for monitoring the file,, but my question is about how I can know when the file was copied.. – John John Nov 29 '16 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.