possible stolen files

[chrisn]

i work for a very small company and have become the defacto system admin. unfortunately, my boss wants me to find out if an employee who just left stole files and possibly downloaded them to a flash drive. is there any way i can do that? the PC has XP.

thanks.

 

[jmwills]

The person has left the company, how can you track this? How long ago are we talking about?

 

[A+Computer]

There's no way to detect this unless, it was being monitored to begin with.

 

[jmwills]

I beg to differ. The event logs would show the USB connection, that's why I asked how long ago this occured. However, this would only show the connection not anything else.

 

[A+Computer]

this would only show the connection not anything else.

Then why check it? So begging to differ when it's not showing anything, is a pointless action. If I see my tire flat, I don't need to go touch it to confirm it's flat. So why check event viewer to see it's not gonna tell me anything that's useful.

Again, there's no way to tell unless it was being monitored prior to this happening.

 

[jmwills]

However, this would only show the connection not anything else.

Can you read? I said this would only say that a USB connection was made..not saying it proved the files were taken. Geez!

 

[A+Computer]

However, this would only show the connection not anything else.

Can you read? I said this would only say that a USB connection was made..not saying it proved the files were taken. Geez!

I've since edited my post lol can you?

 

[chrisn]

thanks for the info. no, it was not being monitored previously. i'm thinking we need to check in the last month or so. how can i tell if there was a USB connection?

 

[A+Computer]

Start run -> eventvwr.msc According to jmwills. But I just plugged in a USB and nothing was recorded in event viewer. There's nothing you can do.

http://www.irongeek.com/i.php?page=security/usb-hardware-keyloggers-1-keycarbon&mode=print