Printable View
hello All,
I encounter a technological problem about how to monitor the copied file origin.
Example, i have a file named aa.txt, it localed on disk C.Then i drag it to disk D,or i copy it to Disk D using Crtl+C, Ctrl+V. Now is there any method to let me know aa.txt from Disk C.
i have tried to using hook api ,and SHChangeNotifyRegister to resovle this problem, but at last i also cann't get it
Thanks All
hello All,
I encounter a technological problem about how to monitor the copied file origin.
Example, i have a file named aa.txt, it localed on disk C.Then i drag it to disk D,or i copy it to Disk D using Crtl+C, Ctrl+V. Now is there any method to let me know aa.txt from Disk C.
i have tried to using hook api ,and SHChangeNotifyRegister to resovle this problem, but at last i also cann't get it
i also using Win Api CopyFileEx() to get it, it's also uselessfull.
Thanks All for giving me some technological ideas.
It's not possible.
Please do not create duplicate posts with the same problem.
SHChangeNotifyRegister can not tell the "origin" of file.
I'm not aware of any way to do this.
There's a new library coming up, with which one would be able to detect all hdd activity, with lots of details available, including the name and age of the person that pressed the Ctrl+C Ctrl+V combo (as long as that wasn't the cat)... :rolleyes: but the major drawback is that will be very expensive to purchase... :D
...
Feng, files can be created in many ways, by many implementations, some not even using APIs nor code from the existing / installed OS. File-copy commands are also implementations that read & write files. In conclusion, a generic "hook" on ALL file copying commands is not possible to retrieve such information. The only thing possible to monitor is HDD / folder content, by capturing changes in the structures maintaining such info (ex. File Allocation Table as in FAT32 formatted disks). But how a new file appeared in a folder is not possible to determine.
If you explain in more details what are you trying to achieve, there might be other ways. For example, if you're planning to monitor only a certain application, then code patching always works. ;) Or if you are trying to get that info only for copy/cut+paste operations, then you can study how Clipboard management works, in order to monitor its activity.
No offence, but I feel you'll need to do a lot of reading before you can manage such advanced concepts.
Regards,
[ merged threads ]
Please do not cross post your question.
sorry all,
I thread two same posts to resolve this technological issue。
Because this technological problem is very important for me.
And Thanks for Bornish's reply.
This function is about that，between different disk, copy files, automatically encryption.
At the same time, there are some virtual disks in the PC. If a file is moved from a physical disk drive to another physical disk drive, we don't need to encryption. Only when a file is from virtual disk and move to a physical disk drive, complete encryption.
I want to monitor a file where comes from , and through judge different paths to complete encryption.
Regards
Feng, the situation you're having is as complicated as interesting... it might required a huge amount of testing involved, especially if this is an internal security requirement.
If you're familiar with injecting code in other processes and with code patching in memory, you might be able to try different techniques that determine when a file is being copied (at least when using known APIs) by all running applications / services. You might have to disassembly & debug such implementations, in order to determine how parameters are passed and how exactly do they know from where to copy the file. Be aware that paths may also be relative to the current directory of the application.
Hope I didn't scare you, but I really believe you're facing a really challenging situation (not to call it "impossible"). :)
Good luck,
it is really a challenge .
If anyone has a idea or any materials about this issue，please give me a guide。
Regards
Hey guys,
I am also facing a similar kind of problem.
Reply me if it is possible.
Thanks in advance.
-Pratik