Tracking or auditing file copy

Question

Everything that I know about programming tells me that this isn't a trivial task, but is there a way to track if something has been copied off a computer to an external drive? All I can find in Windows 7 is "Audit object access" which doesn't appear to differentiate between copying and reading ( and I understand that a copy is basically a read operation with a parallel write operation ).

So is there something that I'm missing or is this not possible without third party software?

Solution 1

We did our own research before on this topic working our own software for file server auditing and it could not find any ways to implement this feature. But it was asked frequently by our customers. Yes, just because copy is technically a read then write operation the only way to monitor it is to monitor both reads from the source and writes to the destination and then try to correlate it.

Solution 2

You're not missing anything. A copy is a read operation.

Solution 3

Some AntiVirus applications will log files written to an external device. A similar approach might be a better way to look at the problem.

Comments

[Paranoid guy]

No I'm asking about the admin aspect of it. I mentioned programming just because, well, that's the way I try to think of everything i.e "how would this be implemented in code anyway?"

[John Gardeniers]

@Paranoid, it's all there in the event logs but it's anything but easy to find or interpret. That's why I would only do this programmatically.