RE: Determining if someone copied file to a: drive

From: jonathan bloomquist (col_panic2at_private)
Date: Wed May 30 2001 - 13:41:34 PDT

Next message: Troy Larson: "RE: Registry Key LastWrite times"

Previous message: crazytrain.com: "RE: Determining if someone copied file to a: drive"
In reply to: Medina, Patricia L.: "RE: Determining if someone copied file to a: drive"
Next in thread: crazytrain.com: "RE: Determining if someone copied file to a: drive"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

--- "Medina, Patricia L." <plmedinat_private>
wrote:
> 
> 
> -----Original Message-----
> From: mshines [mailto:mshinesat_private]
> Sent: Wednesday, May 30, 2001 8:14 AM
> To: forensicsat_private
> Subject: RE: Determining if someone copied file to
> a: drive
> 
> 
> Look in the Recent Files information...    which is
> displayed on the
> Start -> Documents listing from the Task Bar.
> 
> The Recent Documents are also in the folder (which
> is really what is
> displayed on the task bar) -
> C:\Winnt\Profiles\<the profile of interest>\Recent
> 
> Hope this helps.  NT does leave a trace of the last
> few files touched.

Yes, but please note that a file copied to floppy from
a command prompt does not appear in the recent files list.

__________________________________________________
Do You Yahoo!?
Get personalized email addresses from Yahoo! Mail - only $35 
a year!  http://personal.mail.yahoo.com/

Next message: Troy Larson: "RE: Registry Key LastWrite times"
Previous message: crazytrain.com: "RE: Determining if someone copied file to a: drive"
In reply to: Medina, Patricia L.: "RE: Determining if someone copied file to a: drive"
Next in thread: crazytrain.com: "RE: Determining if someone copied file to a: drive"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu May 31 2001 - 09:08:59 PDT