Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A pendrive with some sensitive files were connected to a Windows XP computer. I'll have access to that computer, now it's turned off.

How can I analyze if some or all files from my pendrive were copied, moved or deleted? What kind of programs can I use, what files or clues can I have ? I don't know it log were enable in Windows XP.

share|improve this question
In short, unless this is a special flash device which does internal logging, or you have an audit log of system calls in the target computer, or there's a rootkit doing the same, you don't. The rule is: if there are any data you don't want other people to see, don't give them the data in the first place. – Deer Hunter Jun 5 '13 at 11:24
@DeerHunter: yes I know its my mistake. But any case to know/analyze If my file on flash drive has copy or not? Thank you – Lena Queen Jun 5 '13 at 11:27
No, you can't know if it has been copied; you can try searching through the filesystem on the target computer - if it is possible. Prepare for the worst case (your data have been compromised). – Deer Hunter Jun 5 '13 at 11:32
@DeerHunter: Oh dear , Its my big problem :( – Lena Queen Jun 5 '13 at 11:43

There could be some more information in your question to help us answering it. Ideally, which Operating System (OS) you have (Windows? any Mac?).

And if I understood correctly, you have a pendrive (flash drive) with some sensitive / important files on it, and it's connected to a computer during some time. And you want to know if someone, using that computer, did copy, move, etc., files from or to the pendrive.

In general, you can't know. Just some OS have ability to create a log of this kind of activity. In those systems, you enable logging for all files access that is made, and then you can erad the log to see if something was read. I'm assuming that you are using Windows home-edition...

To avoid loosing information from your pendrive (someone deleting), the protection is to have a backup somewhere else.

To avoid having sensitive files read from it, the solution is to protect those files with some encryption, so that anyone who copies the file won't be able to read its contents. For example, you can password protect Word / OpenOffice files, you can zip your files using password protection, you can use Truecrypt to create a virtual protected drive inside your pendrive...

Give more details on what you need, and people will be able to give better ideas.

share|improve this answer
The computer that my pendrive connect use windows xp. Oh deaar I have big problem. Anything software or anything trick to knowing the case? Thanks – Lena Queen Jun 5 '13 at 11:42
@LenaQueen : your pendrive can't tell you what was copyied to/from it. You could have any chance if you have access to the windows xp computer, and is able to analyze it. Can you ? – woliveirajr Jun 5 '13 at 11:46
Yes I can but now the computer is shut down maybe tomorrow I can access and analyze. How do that? – Lena Queen Jun 5 '13 at 11:48
in this question you have some hints:… – woliveirajr Jun 5 '13 at 11:54
I edited your question to reflect what you told us and what you need to know... – woliveirajr Jun 5 '13 at 11:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.