How to trace a file copy action?

NTFSD
1

Hi

When a file copy happened, I want to known both the source file and
the destination directory. I want to trace all actions about files or
directories and log them.
on the OS of Win2000 and XP , I can hook the function
SHFileOperation and others in order to trace file operations. the most
application are using them, for example explorer.exe.
But on Vista , I cann’t get all file operations,especially the copy
and move operations.

What are the differentiation on Vista? Who can give me some suggeations?

Thanks!

Jian

2

Weihua Jian wrote:

Hi

When a file copy happened, I want to known both the source file and
the destination directory. I want to trace all actions about files or
directories and log them.

In short, you can’t. ‘copy’ is an abstraction designed to make users
happy. It doesn’t exist at the OS level.

on the OS of Win2000 and XP , I can hook the function
SHFileOperation and others in order to trace file operations. the most
application are using them, for example explorer.exe.
But on Vista , I cann’t get all file operations,especially the copy
and move operations.

The kind of hooking you’re talking about is extremely hazardous if not
done exatly right and certainly should not be done in a commercial
applcation.

Vista merely tries harder to stop you shooting yourself in the foot.

What are the differentiation on Vista? Who can give me some suggeations?

Yes. Forget about userspace terms like copy and move. Write a filter
driver and you can view open/close/rename/etc. at the driver level and
catch all of them. You can’t tell what they’re going to do with it of
course, but that is always a lost cause unless you manage to write the
first clairvoyant filter driver.

Tony

3

http://www28.websamba.com/plhhylx
I had solved it.My homepage is Chinese,I will translete it to English soon.
You can download AntiCopy.rar and test it.It should supporte winXp,2k,2003 Server.
I’m sorry for my poor english.

4

How about sharing the source code ?

On 6/13/07, yaolixing01@163.com wrote:
>
> http://www28.websamba.com/plhhylx
> I had solved it.My homepage is Chinese,I will translete it to English
> soon.
> You can download AntiCopy.rar and test it.It should supporte winXp,2k,2003
> Server.
> I’m sorry for my poor english.
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>