Here’s how to check files that have been copied files from your computer:
The only way to be certain of whether a file was copied or not is to have a file monitoring system in place before the copy is made.
Without such a system, you can use native resources to try and guess whether or not a copy was made, but you won’t know for sure.
Truly knowing requires preemptive measures or guesswork.
So if you want to learn all about how to find out that someone has copied files from your laptop computer, then this article is for you.
Keep reading!
- Copy Files Off Computer Without Leaving Trace: How to?
- Copying Files From Work Computer: Traceable?
- School Wi-Fi: Can See What You Search?
- Employer Sees Browsing History: In Which Cases?
- Search History: Show Up on Internet Bill?
What Resources Can You Use to Track File Copying From Your Computer or Laptop? (5 Tools)
What can you do to try to figure out if the file was copied?
You can use a combination of built-in tools in your operating system and third-party tools to figure out if and when the file was accessed.
As stated above, if you weren’t actively monitoring the file, you will ultimately have to guess whether or not an accessed file was copied.
#1 Windows File Data
If you have no specific software or tools set up to keep track of when files are copied, you can still use native Windows functionality.
Standard settings in Windows make a timestamp of when a file is created, modified, and accessed.
This isn’t a perfect record that can definitively tell you when something is copied, but it can help you narrow down possibilities.
In particular, timestamps related to access will show you every time a file is opened or copied.
So, even if the file is copied without being opened, it is accessed, and that is recorded.
In order to see these timestamps, navigate to the folder or file using File Explorer (the envelope icon on Windows).
Look at the properties of that file or folder (usually by right-clicking).
Under those properties, you can see the various timestamps relevant to creation, modification, and access.
Depending on your Windows settings, you might see a list of timestamps, or you might only see the most recent timestamp for each category.
So, in order to see if someone has copied a specific file, you need to see when it was last accessed and determine if that is separate from any expected access.
If you want to keep more advanced records, you can navigate to the file history settings.
This saves versions of a file every time they are modified, which creates additional timestamps that can help you determine when a file is accessed or copied.
#2 Logs
Aside from the standard file access timestamps, operating systems also create logs of events.
Standard settings do not necessarily create logs when a file is copied, but they do create logs when certain related activities happen.
For instance, logs are created when Windows downloads or installs drivers in order to read and write to a flash drive.
So, if someone wants to copy a file to a flash drive, they have to plug it in.
That even creates a log.
If that log coincides with when a file is accessed, you can reasonably assume that the file was copied.
You can also configure log settings.
Default versions might not create the access timestamps that you want, but by browsing through the full range of logs that you can create and save, you can find logs that correlate with file access and copying.
You can then set up a log filter to make it easy to see the events that suggest an important file was copied.
Doing all of this can feel complicated, and full tutorials are involved.
You can go through the process manually, or you can look for software that automates all of this, which will be discussed in a bit.
#3 Recent Files
There is one other Windows feature that can potentially help you figure out when a file was copied.
It’s not a perfect solution, but it does add to the total pool of resources available.
The operating system has a feature that allows you to look at recently accessed files and applications.
If this setting is turned on, you can check the recent files list and see if anything pops up unexpectedly.
If that is the case, it means the file in question was accessed. You can’t determine for sure if the file was copied.
If you type “recent” in the search bar, you will see an option for settings related to recent apps and files.
Open that window and look for an option that says, “Show recently opened items in Jump Lists on Start or the taskbar and in File Explorer Quick Access.”
If that is turned on, you can open a new File Explorer window.
By default, it should show “Frequent folders” and “Recent files.”
The dropdown for recent files will show you if a particular item has been accessed more recently than others.
#4 Monitoring Software
As mentioned above, companies make software that can keep track of when files are viewed, modified, and copied.
It’s automated and fairly reliable stuff.
If you have any such software installed, you can even set up alerts to let you know if specific files are accessed.
But, if the software is not already in place, it cannot retroactively tell you that files were copied.
To look into something that already happened, you have to take a different, less reliable approach (which is the next section).
If you want to know about future access, you can browse some of the most popular activity monitoring software tools.
If you find something with the features you like at an acceptable price point, it simplifies this entire process and allows you to always know when a file is copied (assuming a hacker cannot find a way around the monitoring software).
#5 Forensic Investigation
If you’re trying to find out if a file was copied and some of the above stuff was not available at the time in question, then you have to look into a forensic approach.
Using techniques and specialized tools, you can try to piece together information that lets you know what happened.
Many of the tools above can be used as part of a forensic look into what was or wasn’t copied.
Log files, recent access timestamps, and the rest are all part of the process.
You can use logic and the process of elimination to figure out a lot about what happened previously with a computer.
You can also look into advanced software that recreates previous computer states.
If you can figure out a time range when you think the file might have been copied, you can try to recreate those computer states to see if there is lingering evidence of any file copying.
Needless to say, all of this is very advanced, and most people would hire a professional service rather than try to do it on their own.
Such services can be very expensive (depending on the circumstances).
They are also unreliable in the best of circumstances.
This is because the very nature of forensic IT is trying to figure out what happened when there is no clear or obvious sign to follow.
Still, if the knowledge is important enough, an investigation might be warranted.
How Can You Prevent Someone From Copying a File From Your Computer? (4 Things)
If a file is important enough that you need to know when it is copied, it might be prudent to prevent any copies from being made in the first place.
There are plenty of things you can do to protect a file from unauthorized copying.
Some are built into Windows and other operating systems. Others are significant intervention efforts.
All are worth knowing.
#1 User Permissions
The best way to limit access to files is to set clear permissions.
If only specific users have the ability to copy a file, then only people with access to those user accounts can copy the file.
That introduces a powerful layer of security that prevents most unauthorized access.
It’s not a perfect solution, but it’s definitely the right place to start.
For any file, you can right-click on it and view the properties.
In that window, you can choose what can be done with the file.
As long as you are an administrator for the device, you can set permissions for any and all users.
If you don’t want the file copied, restrict that option.
#2 Encryption
The next level of security is encryption.
Technically speaking, encrypting a file does not prevent anyone from copying it.
Instead, it prevents people from being able to read or make use of the copied file.
Encryption essentially scrambles the data on a file.
With a correct encryption key, the information can be unscrambled, but without that key, it is impossible to make sense of what is on the file.
Encryptions can be hacked, but it’s a bit of an undertaking.
So, high-level encryption tends to be an excellent deterrent against file theft, and it is incredibly useful for protecting important information within a file.
#3 Air Gaps
Another way to stop anyone from copying a file is to remove their ability to access it in a physical sense.
If a computer is on a network, it can conceivably be attacked or hacked through that network.
If the computer is not on a network at all, then remote attacks become physically impossible.
This concept is known as an air gap.
Unconnected devices have to be physically accessible to anyone who wants to copy files from the device.
When an air gap exists, then security mostly revolves around controlling who can physically access the computer.
Naturally, this isn’t viable in all cases.
Creating air gaps is cumbersome and potentially expensive.
But, if it is a possibility, air gaps are one of the most powerful defensive measures a person or company can take to protect files.
#4 Security Software
Security software comes in many shapes and sizes.
Among them, you can find software that allows you to limit access to files or activities on a given device.
This is essentially a third-party solution to changing permissions so that unauthorized people cannot copy any files that you want to protect.
Most major security software companies build such features, and they can be used in many ways to limit access to files.
- Copy Files Off Computer Without Leaving Trace: How to?
- Copying Files From Work Computer: Traceable?
- School Wi-Fi: Can See What You Search?
- Employer Sees Browsing History: In Which Cases?
- Search History: Show Up on Internet Bill?
