Have you ever wanted to know when files were modified or accessed on your computer? How about on a server? Maybe someone has been opening your files and changing data? Or maybe someone is trying to do a little corporate espionage”¦
Sure you could use Group Policy to monitor files for changes, but how many of you out there know how to do that? Instead, a small portable application called HDD Profiler rocks hard core. It can tell you who has modified, accessed or created a new file/folder inside the folder you are monitoring”¦.that’s a mouth full! Long story short – you can tell what was accessed or changed by a simple snapshot method.
I have a directory in mind. One that I want to monitor, but I also don’t want anyone to know that I am watching this folder and with HDD Profiler that is exactly what you get.
When you run it, you will see a screen that looks like this:
You can see that there are tabs for each of these: New Files, Removed Files, Created Files, Modified Files, Resized Files, New Folders and Removed Folders. There will be nothing in any of the tabs initially. We need to take a snap shot of the folder we want to monitor first. I choose my desktop by hitting either F8 or go to the Menu – Task – Snapshot.
Choose a folder you want to monitor for changes and a folder to store the snapshot file. If you are working locally check the Local Snapshot button. Leave it un-checked if you are using a remote machine’s folder. Then simply hit SnapIt.
It will save the snapshot file to your specified directory. These snapshot files all will have a .hps extension. I save mine to My Documents. Next go ahead and make some changes to that folder. I created some new sub-folders, renamed a file, deleted a file and opened a document. HDD Profiler recorded all of that for me. Let’s take a look.
To compare the current version of the folder against your snapshot you hit Menu – Task – Profile or F9. After you do that you should be able to see all the changes you made to the folders contents. There is no user information associated with it but you will know that someone messed with something!
This is an awesome way to manually monitor files for changes that no one will know is in place. The only downside of this application is that you need to manually snapshot the folder in question and you need to know about the problem before it happens”¦.hey some of us Admins stay ahead of the game!
For me I will be using this to watch some of the executive folders on a local server to see who has been accessing what. You can put this to use when you think someone is spying on you or maybe someone is randomly deleting files. This will help you become Sherlock Holmes!
How do you track folder usage or audit your file system? Maybe someone out there has an easier way or something a little more automated?
We would love to hear about your ways in the comments!