1

Is there any method or tool which will allow to monitor activity on USB? With activity I mean if you can by any chance see if files like (pdf, jpeg, doc, etc, ...) was copied or opened on USB device.

closed as too broad by Serge Ballesta, Steve, Steffen Ullrich, Bacon Brad, CaffeineAddiction Sep 29 '17 at 5:05

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Are you looking for spyware recommendations? – skooog Sep 27 '17 at 8:13
  • @skooog No. I am looking for forensics tool. – Dejan Sep 27 '17 at 18:39
  • 1
    Wireshark now has a USB monitoring module. Have you looked at that? – SDsolar Sep 27 '17 at 21:22
  • So, it looks like you are not concerned with USB or even monitoring. You want to know how to know if any file has been accessed. (Monitoring != forensics) Could you edit your question to reflect the broader definition? – schroeder Sep 28 '17 at 9:42
4

There are three timestamps normally recorded:

  • mtime - updated when the file contents change. This is the "default" file time in most cases.
  • ctime - updated when the file or its metadata (owner, permissions) change
  • atime - updated when the file is read

For your need you will need atime, so you can open your USB device in terminal:

user@ubuntu:/media/USB-2477$

and run: ls -l --time=atime myfile.pdf

This will return to you when was the last time when you accessed that file. For copying the file I'm not sure if that will be recorded.

Or use stat it has similar function:

 stat --printf="Change %z\nAccess %x\nModify %y\n" myfile.pdf

It will return:

Change 2017-09-27 21:06:23.000000000 
Access 2017-09-27 22:04:00.000000000 
Modify 2017-08-11 21:36:40.000000000 
  • 1
    as long as you don't mount the filesystem with noatime or readonly (which one might choose to do on write-limited devices) – symcbean Sep 28 '17 at 11:57
  • Also note that these times can be changed arbitrarily, they are in no way secure. – AndrolGenhald Sep 28 '17 at 13:39
  • 1
    For ext4 at least (which I assume since you're using Ubuntu), there are also two other hidden timestamps, crtime (called btime on some filesystems) which records the creation time of the file, and dtime which marks the time of inode deletion. They are both recorded, just not accessible through stat(). – forest Nov 1 '18 at 8:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.