Home All Groups Group Topic Archive Search About

Track Files Copying Out Of PC

Author
19 Sep 2005 7:25 AM
tslu69
Can I track what files are being copied out of my PC? If yes, how do I go
about doing it

Author
19 Sep 2005 7:36 AM
Michael Cole
tslu69 wrote:
> Can I track what files are being copied out of my PC? If yes, how do
> I go about doing it

Copied out how?  Floppy disk?  Network connection via shared drive?  FTP?

--
Regards,

Michael Cole
Author
19 Sep 2005 7:47 AM
tslu69
It can be copying files out of a PC to another hard disk, floppy disks,
network drives or any USB devices

regards,
Oliver

Show quoteHide quote
"Michael Cole" <no***@hansen.com> wrote in message
news:OFlKszOvFHA.1988@TK2MSFTNGP10.phx.gbl...
> tslu69 wrote:
>> Can I track what files are being copied out of my PC? If yes, how do
>> I go about doing it
>
> Copied out how?  Floppy disk?  Network connection via shared drive?  FTP?
>
> --
> Regards,
>
> Michael Cole
>
>
Author
19 Sep 2005 8:38 AM
J French
On Mon, 19 Sep 2005 15:47:20 +0800, "tslu69" <tsl***@yahoo.com> wrote:

>It can be copying files out of a PC to another hard disk, floppy disks,
>network drives or any USB devices

It can be done, FileMon from SystemInternals does it
- also that is how most virus checkers work

http://www.sysinternals.com/Utilities/Filemon.html

It could be very difficult in VB
Author
19 Sep 2005 11:28 AM
Martin
u can use a folder or file notify API?

<<<<<<<<<<<<
VERSION 1.0 CLASS
BEGIN
  MultiUse = -1  'True
  Persistable = 0  'NotPersistable
  DataBindingBehavior = 0  'vbNone
  DataSourceBehavior  = 0  'vbNone
  MTSTransactionMode  = 0  'NotAnMTSObject
Attribute VB_Name = "cFileNotify"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = True
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Option Explicit
Option Base 0
Option Compare Binary
Public Enum EFILE_NOTIFY_CHANGE
   FILE_NOTIFY_CHANGE_ATTRIBUTES = &H4
   FILE_NOTIFY_CHANGE_DIR_NAME = &H2
   FILE_NOTIFY_CHANGE_FILE_NAME = &H1
   FILE_NOTIFY_CHANGE_SIZE = &H8
   FILE_NOTIFY_CHANGE_LAST_WRITE = &H10
   '  FILE_NOTIFY_CHANGE_SECURITY = &H100
   FILE_NOTIFY_CHANGE_ALL = &H4 Or &H2 Or &H1 Or &H8 Or &H10
End Enum
Private Const mlWAIT = 200
Private Declare Function FindFirstChangeNotification Lib "KERNEL32" Alias
"FindFirstChangeNotificationA" (ByVal lpPathName As String, ByVal
bWatchSubtree As Long, ByVal dwNotifyFilter As Long) As Long
Private Declare Function FindCloseChangeNotification Lib "KERNEL32" (ByVal
hChangeHandle As Long) As Long
Private Declare Function FindNextChangeNotification Lib "KERNEL32" (ByVal
hChangeHandle As Long) As Long
Private Declare Function WaitForSingleObject Lib "KERNEL32" (ByVal hHandle
As Long, ByVal dwMilliseconds As Long) As Long
Private Declare Function ResetEvent Lib "KERNEL32" (ByVal hEvent As Long) As
Long
Private Const INVALID_HANDLE_VALUE = -1
Private Enum EWAITNOTIFY
   WAIT_OBJECT = &H0
   WAIT_TIMEOUT = &H102
   WAIT_FAILED = &HFFFF
   INFINITE = &HFFFF
End Enum
Private msDir As String
Private mlNotifyFilter As Long
Private mlHandle As Long
Public Event DirectoryChanged(ByVal vsDirectory As String)
Public Property Get IsRunning() As Boolean
   IsRunning = mlHandle <> 0
End Property
Public Sub StopWatch()
   Call Clear
End Sub
Public Sub WatchDir(ByVal vsDir As String, ByVal vlNotifyFilter As
EFILE_NOTIFY_CHANGE)
   Call Clear
   msDir = vsDir
   mlNotifyFilter = vlNotifyFilter And FILE_NOTIFY_CHANGE_ALL ' make sure
correct filter
   Call HookAndWait
End Sub
Private Sub Clear()
   On Error Resume Next
   If mlHandle <> 0 Then
      Call FindCloseChangeNotification(mlHandle)
      mlHandle = 0
   End If
End Sub
Private Sub HookAndWait()
Dim lResult As Long
    'Set the notification hook
    mlHandle = FindFirstChangeNotification(msDir, False, mlNotifyFilter)
    If mlHandle = INVALID_HANDLE_VALUE Then
       Err.Raise 121, App.Title, "Failed"
    End If

    'Wait until the event is triggered or lWAIT sec passed
    lResult = WAIT_TIMEOUT
    Do While lResult = WAIT_TIMEOUT And mlHandle <> 0
       lResult = WaitForSingleObject(mlHandle, mlWAIT)
       DoEvents
    Loop
    If mlHandle = 0 Then Exit Sub
    If lResult <> WAIT_TIMEOUT Then
       RaiseEvent DirectoryChanged(msDir)
    End If
    Do While mlHandle <> 0
        'Reactivate our hook
           Call FindNextChangeNotification(mlHandle)
           'Wait until the event is triggered
          lResult = WAIT_TIMEOUT
          Do While (lResult = WAIT_TIMEOUT) And (mlHandle <> 0)
             lResult = WaitForSingleObject(mlHandle, mlWAIT)
             DoEvents
             If lResult <> WAIT_OBJECT Then
                RaiseEvent DirectoryChanged(msDir)
             End If
          Loop
    Loop
End Sub