1

I think I have just lost a USB stick. Is there a way to view all the file transfers made from a PC to the external drive, so I can double check everything that was on the drive? Very unlikely, but there are important files that could have been on it.

Does the event viewer log these type of events?

Any help would be appreciated, think I'll stick to cloud storage from now on...

Improve this question
2
  • With respect to your comment on cloud storage: from a security point of view, if you encrypted your flash drive it would be a lot more secure than anything sent into "the cloud."
    – Moses
    Commented May 15, 2013 at 20:29
  • Its funny, because that also popped into my head as soon as i realised what happened.. But i am 99.99% sure everthiny on it was pretty much useless would be nice to check for peace of mind though. I have definitely learnt my lesson though! Novice mistake!
    – Joe
    Commented May 15, 2013 at 20:31

1 Answer 1

Reset to default
0

Does the event viewer log these type of events?

Nope.

If the Event Log logged every file transfer in the system, it'd be full pretty quickly. :)

Can it be set up? Yes, but not without 3rd party software (or some fancy programming/scripting of your own) that monitors for those (specific) file actions/events.

Related SU question: Can a file transfer to a USB pen drive be tracked in windows 7?

Improve this answer
3
  • Thanks for the feedback, if its one file in particular is there a way to view any changes/events of that file? Sorry for the repitition.
    – Joe
    Commented May 15, 2013 at 20:52
  • On the properties of the file mentioned, the modified and accessed dates of the file are the same as the date it was created, does this mean anything in relation to trasnfer? Thanks
    – Joe
    Commented May 15, 2013 at 20:54
  • Doesn't look like it. I just tried (from SU question How can I display the time stamp of a file with seconds, from the command line?)) Get-ChildItem akf.txt -Force | Select-Object FullName, CreationTime, LastAccessTime, LastWriteTime That shows all of that file's time. Then I copied the file as akf2 and ran that command on akf2.txt. Looking at the source file,the access time didn't change to the creation and access time of the copied file.Another thing I looked at is the archive bit(which can b turned off from a copy) but that happens with cmd's xcopy /m not with windows gui copy or cmd copy
    – barlop
    Commented May 15, 2013 at 21:07

Not the answer you're looking for? Browse other questions tagged .