Security Basics mailing list archives
Re: Capturing a programs file output.
From: H Carvey <keydet89 () yahoo com>
Date: 17 Aug 2004 10:55:17 -0000
In-Reply-To: <NBEKIFFBLHEDMLEGHBDMIEBIDGAA.mop () arach net au> Kim,
Can anyone suggest a freeware tool for Windows that can log: a) The file access of a selected application, such as opening,/closing of files, what is written, and if possible the offset the write occured at. b) Access to a selected file by any application. Either capability would be useful, but preferably both. Timestamping would also be helpful.
I've written something like this, that provides some of the capability that you've asked for. Using the Win32::AdvNotify Perl module, I wrote a file system monitor for NT and IIS 4.0 that would automatically replace defaced web pages. That same application can be easily expanded to cover file opens/closes, timestamp the events, etc. However, to perform the rest of the functions, additional capabilities would be required, such as having original copies of all files in order to show what changed. I've often thought about writing the Perl script as a Windows service. I think that you can get some of this capability with FileMon from SysInternals, as well. Harlan --------------------------------------------------------------------------- Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off any course! All of our class sizes are guaranteed to be 10 students or less to facilitate one-on-one interaction with one of our expert instructors. Attend a course taught by an expert instructor with years of in-the-field pen testing experience in our state of the art hacking lab. Master the skills of an Ethical Hacker to better assess the security of your organization. Visit us at: http://www.infosecinstitute.com/courses/ethical_hacking_training.html ----------------------------------------------------------------------------
Current thread:
- Capturing a programs file output. mop (Aug 16)
- Re: Capturing a programs file output. Niek (Aug 17)
- Re: Capturing a programs file output. Ansgar -59cobalt- Wiechers (Aug 17)
- Re: Capturing a programs file output. Tomasz Onyszko (Aug 17)
- Re: Capturing a programs file output. Barrie Dempster (Aug 18)
- RE: Capturing a programs file output. TheMadScientist (Aug 19)
- Re: Capturing a programs file output. rohithj (Aug 20)
- <Possible follow-ups>
- Re: Capturing a programs file output. H Carvey (Aug 17)
- RE: Capturing a programs file output. CHRIS GRABENSTEIN (Aug 17)
- Re: Capturing a programs file output. Nelson Santos (Aug 18)