history of memory stick access

[Guest charlierandall73@googlemail.com]

Hi,

 

A customer of ours left a USB memory stick in our office and his IT

manager is claiming that somebody copied something off of it whilst it

was here. He said he can tell it was at 6.45 am

 

My questions are:

 

1- Does copying a file leave a trace on a memory stick?

2- If the answer is yes, will a record be stored on our computers and

under whose logon (maybe in the event history?)

 

thanks

Charlie

[Guest S. Pidgorny]

G'day:

 

charlierandall73@googlemail.com wrote:

<span style="color:blue">

> A customer of ours left a USB memory stick in our office and his IT

> manager is claiming that somebody copied something off of it whilst it

> was here. He said he can tell it was at 6.45 am

>

> My questions are:

>

> 1- Does copying a file leave a trace on a memory stick?

> 2- If the answer is yes, will a record be stored on our computers and

> under whose logon (maybe in the event history?)</span>

 

There are file system attributes eg creation, modification and access

timestamps, so the answer to #1 is yes. Although I must say that the

information in those attributes isn't guaranteed to be accurate.

 

Memory sticks usually formatted to FAT and have no access audit enabled

on the files. Therefore there will be no information apart from the

logon audit trail, as configured in your org.

 

 

--

Svyatoslav Pidgorny, MS MVP - Security, MCSE

-= F1 is the key =-

 

http://sl.mvps.org http://msmvps.com/blogs/sp