My friend asked me for some files that I let him take from my system. I did not see he doing that. Then I was left with a doubt: what extra files or data did he take from my system?

I was thinking is here any application or method which shows what data is copied to which USB (if name available then shows name or otherwise device id) and what data is being copied to Ubuntu machine . It is some like history of USB and System data. I think this feature exists in KDE

This will really useful in may ways. It provides real time and monitoring utility to monitor USB mass storage devices activities on any machine.

  • Check inotify. It is an API, not a program to use out of the box. ibm.com/developerworks/linux/library/l-ubuntu-inotify/… It may help you make better search engine queries searching for tools. – jippie Apr 11 '12 at 21:29
  • what data is copied to which USB - I think you meant data as any file in all mounted partitions. But copying system files which are allowed you to read as a user isn't dangerous, cause sensitive system files belong to root user. So your friend couldn't read them without sudo password. Right? This reason is applicable to writing from usb to system files. It's impossible to write to them without knowing of sudo password. Thus data means your $HOME content. Is that correct? – zuba Apr 16 '12 at 13:15
  • Also what data in $HOME do you want to watch for? ~/Documents?, ~/.cofig?, ~/.anything_else? – zuba Apr 16 '12 at 13:22

It appears that inotifywatch can do the job. Refer to the IBM document I reference in the comment above for more information and its manual page. To install:

apt-cache search inotify
  • inotifywait - wait for changes to files using inotify
  • inotifywatch - gather filesystem access statistics using inotify

You can do this:

1) Check the files: /var/log/kern.log and /var/log/kern.log.1 and search the time and date that your friend connected the usb mass storage. For example, mine says:

Apr  9 13:41:37 desguai7 kernel: [16788.372616] USB Mass Storage support registered.
Apr  9 13:41:38 desguai7 kernel: [16789.370861] scsi 6:0:0:0: Direct-Access     SanDisk  Cruzer Blade     1.20 PQ: 0 ANSI: 5
Apr  9 13:41:38 desguai7 kernel: [16789.386614] sd 6:0:0:0: Attached scsi generic sg2 type 0
Apr  9 13:41:38 desguai7 kernel: [16789.390966] sd 6:0:0:0: [sdb] 15633408 512-byte logical blocks: (8.00 GB/7.45 GiB)
Apr  9 13:41:38 desguai7 kernel: [16789.392246] sd 6:0:0:0: [sdb] Write Protect is off
Apr  9 13:41:38 desguai7 kernel: [16789.392258] sd 6:0:0:0: [sdb] Mode Sense: 43 00 00 00
Apr  9 13:41:38 desguai7 kernel: [16789.392980] sd 6:0:0:0: [sdb] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA
Apr  9 13:41:38 desguai7 kernel: [16789.401326]  sdb: sdb1
Apr  9 13:41:38 desguai7 kernel: [16789.404486] sd 6:0:0:0: [sdb] Attached SCSI removable disk

So April 9, at 13:41 (1:41pm) a USB Mass Storage was registered (connected) at my computer.

2) Now lets see the last time some files get accessed and search for matching dates. Open a terminal and paste this:

find ~/the/folder/noone/should/have/looked/ -exec stat -c %n%x "{}" \; | grep "2012-04-09 13:41"  

You will be presented with the file names that were accessed at the time the usb mass storage was connected.

A little trick:

You can use wildcards with grep, like changing grep "2012-04-09 13:41" for grep "2012-04-09 13:4[1234]" to get all files accessed from 13:41 to 13:44.

ps.: It wont work if you have accessed the file after your friend.

  • You would likely need to check each moment from then until you were certain he was done copying (when kern.log shows the USB removal?) Which will be a lot of find/grep statements if he was there fore even 5 minutes. Not impossible, but you'll need a script. – Huckle Apr 14 '12 at 19:19
  • 1
    He would simple change the part (...) grep "2012-04-09 13:41" for grep "2012-04-09 13:4" to get all files accessed from 13:40 to 13:49. – desgua Apr 14 '12 at 20:07
  • 1
    Or he could change grep "2012-04-09 13:41" for grep "2012-04-09 13:4[1234]" to get all files accessed from 13:41 to 13:44. – desgua Apr 14 '12 at 20:21
  • @this could be more hectic job , is there any simple method. – twister_void Apr 15 '12 at 23:33
  • paste gedit /var/log/kern.log on the terminal, Ctrl + F to find "usb mass", check the day and the time your friend attached his USB and you're almost done. Finally open the terminal and paste the command changing the date and time. Give it a test ;-) – desgua Apr 15 '12 at 23:40

Believe me son, one good habit worths a ton of software (and much more reliable indeed). Do NOT lend your session anyone. Just copy files you asked for YOURSELF and feel good.

ps There is no good enough security software for insecure people.

  • Yeah was thinking about that too while driving to work this morning. This is the very reason why user accounts, ownership and file permissions exist (+1). Solutions mentioned here are more an answer to the accountability question. – jippie Apr 12 '12 at 18:43

After an half hour looking on the internet for a solution (which I'd like to found too) I didn't find a software to do it, but this might be an alternative : https://launchpad.net/ubuntu/lucid/amd64/loggedfs

It monitors I/O of a file-system, with some "grep" you may be able to shows the data you're looking for ?

  • You trust your files for safe keeping to a filesystem. Be absolutely sure that you want to start using a filesystem that hasn't had any updates since 2008-09-03 ( sourceforge.net/projects/loggedfs/files/loggedfs ). I wouldn't trust my files to it without regular backups. – jippie Apr 11 '12 at 21:49

wireshark is capable of monitoring all data transferred via USB. Although this application is used mainly to monitor network transfer, it allows you to capture USB packages too. Note that this way you will not get just a list of files, but a byte-by-byte representation of full conversation between your computer and the drive. However, this way you can be completely sure nothing gets hidden from you!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.