+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 21
Windows Thread, File Auditing Software - Kinda urgent in Technical; Does anyone know of any good software for tracking file/folder activity? We have a pupil here who is always complaining ...
  1. #1

    Gatt's Avatar
    Join Date
    Jan 2006
    Posts
    6,659
    Thank Post
    858
    Thanked 646 Times in 429 Posts
    Rep Power
    498

    File Auditing Software - Kinda urgent

    Does anyone know of any good software for tracking file/folder activity?

    We have a pupil here who is always complaining that work is going "missing", despite several password resets

    His parents are now trying to jump on this saying that someone is doing this deliberately

    What I need is an effective way to track what files are created, modified, and deleted in his home folder, as well as the time&date, and by who.

    I have tried Win2k3 File Auditing but this doesn't seem to do much except fill up my Event Log with Object Access events.

    If i need to pay for it then so be it.. :!:

  2. #2

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,593
    Thank Post
    109
    Thanked 764 Times in 595 Posts
    Rep Power
    181

    Re: File Auditing Software - Kinda urgent

    @Gatt: To be honest there is probably only one person that can delete the files (or at least one username). Files don't go missing without a VERY good reason.

    Have you also tried changing the little darling's username to make it more difficult for his friends to log on as him?

  3. #3

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,680
    Thank Post
    516
    Thanked 2,451 Times in 1,897 Posts
    Blog Entries
    24
    Rep Power
    832

    Re: File Auditing Software - Kinda urgent

    The things to check would be who has access to that user's folder and remove access to everyone except the child and yourself.

    That way, the only account that could be deleting work is that user themselves.

    Also, have a look at this. I don't know if it will do what you want though.

  4. #4

    dhicks's Avatar
    Join Date
    Aug 2005
    Location
    Knightsbridge
    Posts
    5,624
    Thank Post
    1,240
    Thanked 778 Times in 675 Posts
    Rep Power
    235

    Re: File Auditing Software - Kinda urgent

    > Does anyone know of any good software for tracking file/folder activity?

    Periodic job running (every hour, more often?) "dir c:\the\path >> log.txt"? This would at least give you the times that files were changed/deleted.

    --
    David Hicks

  5. #5


    Join Date
    Dec 2005
    Location
    In the server room, with the lead pipe.
    Posts
    4,636
    Thank Post
    275
    Thanked 777 Times in 604 Posts
    Rep Power
    223

    Re: File Auditing Software - Kinda urgent

    We have one kid (SEN) here who deletes their own files and has computer "problems" to gain attention. I'm not saying that's the issue at your place, just FYI.

  6. #6

    Gatt's Avatar
    Join Date
    Jan 2006
    Posts
    6,659
    Thank Post
    858
    Thanked 646 Times in 429 Posts
    Rep Power
    498

    Re: File Auditing Software - Kinda urgent

    I have no doubt that the pupil in question is either giving out his password, or is deleting (or claiming to do so) his own work.. but we need something to prove this either way.

    I have got sick of telling staff/pupils that work doesn't just disappear...

    With the pupil's parents involved I need some way to prove one way or another what is going on in his home folder

    I will be going down a Big Brother route with him over the next few days to determine what he is upto.

  7. #7

    elsiegee40's Avatar
    Join Date
    Jan 2007
    Location
    Kent
    Posts
    10,786
    Thank Post
    1,789
    Thanked 2,180 Times in 1,615 Posts
    Rep Power
    771

    Re: File Auditing Software - Kinda urgent

    Do you take Shadow Copies? It happens twice a day here - 7am and 12 noon. Previous Versions is then quite useful for narrowing down the precise timeslots.

    Is it possible the pupil in question is being bullied out of his password?

    Edited in afterthought:

    Make him change his password every time he logs on? A password given away would have to be changed by the offenders and he couldn't possibly know it unless he was told by them!

  8. #8

    SpuffMonkey's Avatar
    Join Date
    Jul 2005
    Posts
    2,235
    Thank Post
    55
    Thanked 278 Times in 186 Posts
    Rep Power
    134

    Re: File Auditing Software - Kinda urgent

    Assuming you have 2003 or similar, turn on File Auditing in the Advanced Security options on the share. You'll then need to wade through the Event Log or employ something like System Change Log from Greyware - we did this after a teacher was "tidying up" everybody else's files on a shared area.

    As stated - if your security is set up right - you will just prove that someone logged on as that child deleted them - then you need CCTV cameras too!

  9. #9
    cookie_monster's Avatar
    Join Date
    May 2007
    Location
    Derbyshire
    Posts
    4,196
    Thank Post
    392
    Thanked 278 Times in 239 Posts
    Rep Power
    74

    Re: File Auditing Software - Kinda urgent

    We use a combination or Windows file auditing - a script that logs when and where a user loggs on and then CCTV in the IT rooms to see who was sat there at the time.

  10. #10
    bandgeekmafia78's Avatar
    Join Date
    May 2007
    Location
    Salford
    Posts
    382
    Thank Post
    88
    Thanked 22 Times in 14 Posts
    Rep Power
    21

    Re: File Auditing Software - Kinda urgent

    Maybe you could use some software to show when this pupil has logged onto the network?

    In all honesty we get a load of kids complaining about lost work, although I think they sometimes say it in order to gain an extension on their homework. Call me cynical but....


  11. #11

    maniac's Avatar
    Join Date
    Feb 2007
    Location
    Kent
    Posts
    3,051
    Thank Post
    209
    Thanked 427 Times in 307 Posts
    Rep Power
    144

    Re: File Auditing Software - Kinda urgent

    Quote Originally Posted by bandgeekmafia78
    In all honesty we get a load of kids complaining about lost work, although I think they sometimes say it in order to gain an extension on their homework. Call me cynical but....

    Same here, and I agree it is a convenient excuse for them to use, and a hard one to dis-prove. We have shadow copies turned on here, takes a snapshot at 7:00am and 12:00pm so we can easily see when the files went missing (if they were ever there in the first place.)

    We've even hauled one kid into our office to sit and watch while we went through all the shadow copies and the backups to try and find his supposed missing file (which we concluded was never there in the first place.)

    Amazing how the story changed as he suddenly realised we can look back at the contents of his directory almost day by day for at least the last 12 months!

    Mike.

  12. #12

    Join Date
    Jul 2007
    Location
    Devon
    Posts
    233
    Thank Post
    8
    Thanked 9 Times in 8 Posts
    Rep Power
    16

    Re: File Auditing Software - Kinda urgent

    Quote Originally Posted by maniac
    Amazing how the story changed as he suddenly realised we can look back at the contents of his directory almost day by day for at least the last 12 months!

    Mike.
    I was under the impression you were only allowed to have 64 previous versions...

    I've had this as issues before several times.

    We whacked up our DC's security log to hold a week or two's worth of logon/logoffs so we used that to determine if the student had logged in elsewhere in college that they've never been.

    If the log indicates they have, change the password and that's that problem solved (unless he lied.. in which case he has fun in detention)

    The other idea might be to utilise Logon Hours and deny him/her access to log on to computers that they don't need to log onto.

  13. #13

    maniac's Avatar
    Join Date
    Feb 2007
    Location
    Kent
    Posts
    3,051
    Thank Post
    209
    Thanked 427 Times in 307 Posts
    Rep Power
    144

    Re: File Auditing Software - Kinda urgent

    Not all of that is shadow copies, the first 30 days are, the rest of it is from the backupexec logs, which takes a full backup, and writes a full very detailed log every night, so we searched these for his folder, and it told us what was there on that day. We keep an end of month tape, so most stuff deleted in the last 12 months is retrieveable.

    Mike.

  14. #14

    Gatt's Avatar
    Join Date
    Jan 2006
    Posts
    6,659
    Thank Post
    858
    Thanked 646 Times in 429 Posts
    Rep Power
    498

    Re: File Auditing Software - Kinda urgent

    We tried backupexec and all it did ws error during every backup attempt
    We use NTBackup and Robocopy at the moment, along with Active@ Undelete to check what has been deleted

    NTBackup is crap and often we end up with some backup stores being corrupted (we backup to an external drive not to tape)

    BackupExec seemed the best solution but I couldn't get it working at all, so as it ws only the trial version i binned it for now.

    Robocopy does seem to work but is slow and takes up a lot more disk space.

    The pupil in question claims that he had a specific folder, but we have found no trace of it, but did find a word doc with the same name.
    However, he has now shown the ICT Teacher another word document with a link to this mystery folder..

    But I am dubious as there is no evidence that this folder ever existed, Active Undelete has found no trace of this folder from september.

    I need to check out this word document and see if this link is a new addition in an attempt to prove us wrong...

  15. #15

    maniac's Avatar
    Join Date
    Feb 2007
    Location
    Kent
    Posts
    3,051
    Thank Post
    209
    Thanked 427 Times in 307 Posts
    Rep Power
    144

    Re: File Auditing Software - Kinda urgent

    Backup exec can be troublesome to get working, but once it is it's very good and reliable in my experience. We get some errors on our backup every night (mainly on exchange mailboxes) but overall it works well, backing up about 500GB of data for us every night.

    Mike.

SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Auditing file creation & deletion
    By SpuffMonkey in forum Windows
    Replies: 7
    Last Post: 28th November 2012, 02:19 AM
  2. Free software auditing software?
    By paulpmp4 in forum Wireless Networks
    Replies: 8
    Last Post: 12th February 2008, 10:57 AM
  3. Free software for auditing DVD collection
    By paulpmp4 in forum How do you do....it?
    Replies: 1
    Last Post: 11th December 2007, 10:59 AM
  4. File recovery software. - Urgent
    By richard in forum *nix
    Replies: 6
    Last Post: 30th November 2007, 02:52 PM
  5. Network auditing software
    By timbo343 in forum Windows
    Replies: 9
    Last Post: 7th March 2007, 07:27 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •