Re: Capturing a programs file output.

[H Carvey <keydet89 () yahoo com>]

In-Reply-To: <NBEKIFFBLHEDMLEGHBDMIEBIDGAA.mop () arach net au>

Kim,

> Can anyone suggest a freeware tool for Windows that can log:
>
> a) The file access of a selected application, such as opening,/closing of
> files, what is written, and if possible the offset the write occured at.
> b) Access to a selected file by any application.
>
> Either capability would be useful, but preferably both. Timestamping would
> also be helpful.

I've written something like this, that provides some of the capability that you've asked for.  Using the 
Win32::AdvNotify Perl module, I wrote a file system monitor for NT and IIS 4.0 that would automatically replace defaced 
web pages.

That same application can be easily expanded to cover file opens/closes, timestamp the events, etc.  However, to 
perform the rest of the functions, additional capabilities would be required, such as having original copies of all 
files in order to show what changed.

I've often thought about writing the Perl script as a Windows service.

I think that you can get some of this capability with FileMon from SysInternals, as well.

Harlan

---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off 
any course! All of our class sizes are guaranteed to be 10 students or less 
to facilitate one-on-one interaction with one of our expert instructors. 
Attend a course taught by an expert instructor with years of in-the-field 
pen testing experience in our state of the art hacking lab. Master the skills 
of an Ethical Hacker to better assess the security of your organization. 
Visit us at: 
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------