+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 21
Windows Thread, File Auditing Software - Kinda urgent in Technical; Does anyone know of any good software for tracking file/folder activity? We have a pupil here who is always complaining ...
  1. #1

    Gatt's Avatar
    Join Date
    Jan 2006
    Posts
    6,724
    Thank Post
    867
    Thanked 665 Times in 437 Posts
    Rep Power
    501

    File Auditing Software - Kinda urgent

    Does anyone know of any good software for tracking file/folder activity?

    We have a pupil here who is always complaining that work is going "missing", despite several password resets

    His parents are now trying to jump on this saying that someone is doing this deliberately

    What I need is an effective way to track what files are created, modified, and deleted in his home folder, as well as the time&date, and by who.

    I have tried Win2k3 File Auditing but this doesn't seem to do much except fill up my Event Log with Object Access events.

    If i need to pay for it then so be it.. :!:

  2. #2

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,592
    Thank Post
    109
    Thanked 770 Times in 598 Posts
    Rep Power
    182

    Re: File Auditing Software - Kinda urgent

    @Gatt: To be honest there is probably only one person that can delete the files (or at least one username). Files don't go missing without a VERY good reason.

    Have you also tried changing the little darling's username to make it more difficult for his friends to log on as him?

  3. #3

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,969
    Thank Post
    519
    Thanked 2,503 Times in 1,943 Posts
    Blog Entries
    24
    Rep Power
    841

    Re: File Auditing Software - Kinda urgent

    The things to check would be who has access to that user's folder and remove access to everyone except the child and yourself.

    That way, the only account that could be deleting work is that user themselves.

    Also, have a look at this. I don't know if it will do what you want though.

  4. #4

    dhicks's Avatar
    Join Date
    Aug 2005
    Location
    Knightsbridge
    Posts
    5,664
    Thank Post
    1,263
    Thanked 786 Times in 683 Posts
    Rep Power
    237

    Re: File Auditing Software - Kinda urgent

    > Does anyone know of any good software for tracking file/folder activity?

    Periodic job running (every hour, more often?) "dir c:\the\path >> log.txt"? This would at least give you the times that files were changed/deleted.

    --
    David Hicks

  5. #5


    Join Date
    Dec 2005
    Location
    In the server room, with the lead pipe.
    Posts
    4,659
    Thank Post
    276
    Thanked 780 Times in 607 Posts
    Rep Power
    224

    Re: File Auditing Software - Kinda urgent

    We have one kid (SEN) here who deletes their own files and has computer "problems" to gain attention. I'm not saying that's the issue at your place, just FYI.

  6. #6

    Gatt's Avatar
    Join Date
    Jan 2006
    Posts
    6,724
    Thank Post
    867
    Thanked 665 Times in 437 Posts
    Rep Power
    501

    Re: File Auditing Software - Kinda urgent

    I have no doubt that the pupil in question is either giving out his password, or is deleting (or claiming to do so) his own work.. but we need something to prove this either way.

    I have got sick of telling staff/pupils that work doesn't just disappear...

    With the pupil's parents involved I need some way to prove one way or another what is going on in his home folder

    I will be going down a Big Brother route with him over the next few days to determine what he is upto.

  7. #7

    elsiegee40's Avatar
    Join Date
    Jan 2007
    Location
    Kent
    Posts
    9,849
    Thank Post
    1,831
    Thanked 2,257 Times in 1,662 Posts
    Rep Power
    806

    Re: File Auditing Software - Kinda urgent

    Do you take Shadow Copies? It happens twice a day here - 7am and 12 noon. Previous Versions is then quite useful for narrowing down the precise timeslots.

    Is it possible the pupil in question is being bullied out of his password?

    Edited in afterthought:

    Make him change his password every time he logs on? A password given away would have to be changed by the offenders and he couldn't possibly know it unless he was told by them!

  8. #8

    SpuffMonkey's Avatar
    Join Date
    Jul 2005
    Posts
    2,250
    Thank Post
    55
    Thanked 280 Times in 187 Posts
    Rep Power
    134

    Re: File Auditing Software - Kinda urgent

    Assuming you have 2003 or similar, turn on File Auditing in the Advanced Security options on the share. You'll then need to wade through the Event Log or employ something like System Change Log from Greyware - we did this after a teacher was "tidying up" everybody else's files on a shared area.

    As stated - if your security is set up right - you will just prove that someone logged on as that child deleted them - then you need CCTV cameras too!

  9. #9
    cookie_monster's Avatar
    Join Date
    May 2007
    Location
    Derbyshire
    Posts
    4,207
    Thank Post
    394
    Thanked 278 Times in 239 Posts
    Rep Power
    74

    Re: File Auditing Software - Kinda urgent

    We use a combination or Windows file auditing - a script that logs when and where a user loggs on and then CCTV in the IT rooms to see who was sat there at the time.

  10. #10
    bandgeekmafia78's Avatar
    Join Date
    May 2007
    Location
    Salford
    Posts
    382
    Thank Post
    88
    Thanked 22 Times in 14 Posts
    Rep Power
    21

    Re: File Auditing Software - Kinda urgent

    Maybe you could use some software to show when this pupil has logged onto the network?

    In all honesty we get a load of kids complaining about lost work, although I think they sometimes say it in order to gain an extension on their homework. Call me cynical but....


  11. #11

    maniac's Avatar
    Join Date
    Feb 2007
    Location
    Kent
    Posts
    3,069
    Thank Post
    210
    Thanked 430 Times in 310 Posts
    Rep Power
    144

    Re: File Auditing Software - Kinda urgent

    Quote Originally Posted by bandgeekmafia78
    In all honesty we get a load of kids complaining about lost work, although I think they sometimes say it in order to gain an extension on their homework. Call me cynical but....

    Same here, and I agree it is a convenient excuse for them to use, and a hard one to dis-prove. We have shadow copies turned on here, takes a snapshot at 7:00am and 12:00pm so we can easily see when the files went missing (if they were ever there in the first place.)

    We've even hauled one kid into our office to sit and watch while we went through all the shadow copies and the backups to try and find his supposed missing file (which we concluded was never there in the first place.)

    Amazing how the story changed as he suddenly realised we can look back at the contents of his directory almost day by day for at least the last 12 months!

    Mike.

  12. #12

    Join Date
    Jul 2007
    Location
    Devon
    Posts
    233
    Thank Post
    8
    Thanked 9 Times in 8 Posts
    Rep Power
    16

    Re: File Auditing Software - Kinda urgent

    Quote Originally Posted by maniac
    Amazing how the story changed as he suddenly realised we can look back at the contents of his directory almost day by day for at least the last 12 months!

    Mike.
    I was under the impression you were only allowed to have 64 previous versions...

    I've had this as issues before several times.

    We whacked up our DC's security log to hold a week or two's worth of logon/logoffs so we used that to determine if the student had logged in elsewhere in college that they've never been.

    If the log indicates they have, change the password and that's that problem solved (unless he lied.. in which case he has fun in detention)

    The other idea might be to utilise Logon Hours and deny him/her access to log on to computers that they don't need to log onto.

  13. #13

    maniac's Avatar
    Join Date
    Feb 2007
    Location
    Kent
    Posts
    3,069
    Thank Post
    210
    Thanked 430 Times in 310 Posts
    Rep Power
    144

    Re: File Auditing Software - Kinda urgent

    Not all of that is shadow copies, the first 30 days are, the rest of it is from the backupexec logs, which takes a full backup, and writes a full very detailed log every night, so we searched these for his folder, and it told us what was there on that day. We keep an end of month tape, so most stuff deleted in the last 12 months is retrieveable.

    Mike.

  14. #14

    Gatt's Avatar
    Join Date
    Jan 2006
    Posts
    6,724
    Thank Post
    867
    Thanked 665 Times in 437 Posts
    Rep Power
    501

    Re: File Auditing Software - Kinda urgent

    We tried backupexec and all it did ws error during every backup attempt
    We use NTBackup and Robocopy at the moment, along with Active@ Undelete to check what has been deleted

    NTBackup is crap and often we end up with some backup stores being corrupted (we backup to an external drive not to tape)

    BackupExec seemed the best solution but I couldn't get it working at all, so as it ws only the trial version i binned it for now.

    Robocopy does seem to work but is slow and takes up a lot more disk space.

    The pupil in question claims that he had a specific folder, but we have found no trace of it, but did find a word doc with the same name.
    However, he has now shown the ICT Teacher another word document with a link to this mystery folder..

    But I am dubious as there is no evidence that this folder ever existed, Active Undelete has found no trace of this folder from september.

    I need to check out this word document and see if this link is a new addition in an attempt to prove us wrong...

  15. #15

    maniac's Avatar
    Join Date
    Feb 2007
    Location
    Kent
    Posts
    3,069
    Thank Post
    210
    Thanked 430 Times in 310 Posts
    Rep Power
    144

    Re: File Auditing Software - Kinda urgent

    Backup exec can be troublesome to get working, but once it is it's very good and reliable in my experience. We get some errors on our backup every night (mainly on exchange mailboxes) but overall it works well, backing up about 500GB of data for us every night.

    Mike.

SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Auditing file creation & deletion
    By SpuffMonkey in forum Windows
    Replies: 7
    Last Post: 28th November 2012, 02:19 AM
  2. Free software auditing software?
    By paulpmp4 in forum Wireless Networks
    Replies: 8
    Last Post: 12th February 2008, 10:57 AM
  3. Free software for auditing DVD collection
    By paulpmp4 in forum How do you do....it?
    Replies: 1
    Last Post: 11th December 2007, 10:59 AM
  4. File recovery software. - Urgent
    By richard in forum *nix
    Replies: 6
    Last Post: 30th November 2007, 02:52 PM
  5. Network auditing software
    By timbo343 in forum Windows
    Replies: 9
    Last Post: 7th March 2007, 07:27 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •