Trace a file on a network

[Stuart.Atkinson]

Is it possible, to trace a file that was .. copied to a local computer from a network share, even if the file was deleted from the local pc months ago?

 

[FiDoDiDo]

Do you know where the file is and what to know if it is the same file?

If they are the exactly the file and haven't been changed in anyway then you can hash the file on both places and compare the hash values.

 

[Rob.]

Confused, Explain the question a bit more.

 

[dk]

the way i read that is that a file that was located on a share on the network was downloaded to a local PC by someone and then deleted at some point, can it be proved that the file was located on the local pc at some point, maybe it contained sensitive data and shouldn't have been downloaded?

 

[Stuart.Atkinson]

the way i read that is that a file that was located on a share on the network was downloaded to a local PC by someone and then deleted at some point, can it be proved that the file was located on the local pc at some point, maybe it contained sensitive data and shouldn't have been downloaded?

Possibly....

is it possible to trace that?

 

[White16valver]

I hope not :S



LOL

 

[Stuart.Atkinson]

ROFL.
the only way i can think of is packet tracing? but that wont be available unless you are specifically lookingk for it? at that point in time when it was copied??

 

[dk]

if you do this you have to be clever about it, if you have an admin password and have access to servers I would normally log into the server via the administrators account using RDP, then open the file on there, then it could have been opened by anyone!

Not that i have done this obviously

 

[Rob.]

I Don't belive you can do this, Unless you have a computer running as a gateway, Monitoring all network data either as raw packets or some kind of software ( That logs all packets in a organised groups/dates/ips)

Other then this 'MOST' routers don't log this much info.

 

[dk]

ROFL.
the only way i can think of is packet tracing? but that wont be available unless you are specifically lookingk for it? at that point in time when it was copied??

unless anyone is hell bent on finding out i doubt it would be easy to detect, i think they would really have to WANT to find out!

 

[Stuart.Atkinson]

cool, cheers guys!

 

[Daz]

Depends what OS the "server" was running and it's configuration, but yes, it can be done.

Windows server OS's, for example, have auditting, which can log success/failure of object access for example (amongst other things)

http://windows.stanford.edu/docs/security2000.html#audit

 

[dk]

Depends what OS the "server" was running and it's configuration, but yes, it can be done.

Windows server OS's, for example, have auditting, which can log success/failure of object access for example (amongst other things)

http://windows.stanford.edu/docs/security2000.html#audit

surely that wouldn't be set to on though unless they were looking for something specific?

 

[Daz]

Depends what OS the "server" was running and it's configuration, but yes, it can be done.

Windows server OS's, for example, have auditting, which can log success/failure of object access for example (amongst other things)

http://windows.stanford.edu/docs/security2000.html#audit

surely that wouldn't be set to on though unless they were looking for something specific?

Well, only the administrators would know that.
It's perfectly possible that it may be set.. heh.

 

[Stuart.Atkinson]

server 2003.
so in theory you CAN trace this activity then? i thought if a copy was taken and dumped locally that the server wouldn't register it?

 

[gazzrenn]

Depends what OS the "server" was running and it's configuration, but yes, it can be done.

Windows server OS's, for example, have auditting, which can log success/failure of object access for example (amongst other things)

http://windows.stanford.edu/docs/security2000.html#audit

We have this in place on our fileserver.

server 2003.
so in theory you CAN trace this activity then? i thought if a copy was taken and dumped locally that the server wouldn't register it?

The server won't log that it was deleted from your local PC, but it will / can know that you got it from the server.

This is an example from our log...

1/19/2006,16:30:36,8,3,560,Security,DOMAIN\user,SERVERNAME,Security File,D:\shared\Development\folder\folder2\Projects\filename.tmp 608,0,286051200,8,SERVERNAME,DOMAIN

date
time
your domain
your username

The rest is the filename and some other crazy microsoft codes.

Hope this is helpful.

 

[Rob Clark]

depends on whether you have given admin a reason to check the logs (should they exist)
I know most of us are geeks but there are better things to spend your spare time on than checking access logs....

 

[cornburn]

Could you not just run a file recovery program on the local machine and see if it picks up the file you reckon they downloaded as ever being on the local drive? Even if it can't recover it it should give you the file size for comparison?