Is there a way to see if a file has been copied to an USB drive?

(Ex: I have the file secret.db and I suppose that my friend has copied it into his USB drive. With stat $filename I cannot see the updated a/c/m/time because cp doesn't update the timestamps).

Is there a way to know that or it is impossible?

I'm using Ubuntu 12.04 with Bash v4.

  • 2
    If you have a file that could be copied to a USB drive, it could also be read. If its name is secret.db and it can be read by others, then it is no longer a secret! You should use an cipher container (such as EcryptFS or TrueCrypt) to keep your secret file a secret. Then it will give a hard time to your "friend" to read your secret even if they can get a copy of it! – Huygens May 14 '12 at 11:04
  • 1
    Your question is not very clear. Are you trying to ask whether you can tell if somebody made a copy of your file? – invert May 14 '12 at 11:18
  • @Huygens yes, in fact i use encfs :) This is only a question that I have asked myself. – polslinux May 14 '12 at 15:14
  • @Wesley yes, this is what i want to do :) – polslinux May 14 '12 at 15:18
  • 4
    It's as easy to tell as whether someone has taken a picture of your house. – Gilles May 14 '12 at 22:18

TL;DR: In many cases, you can see whether the file was accessed; however, it is impossible to tell whether a copy was made or not.

It seems that atime would be updated when using cp (unless noatime is in effect); however, doing any other read operation (like grep somestring $filename) would also touch the file.

In most installs (without a ton of auditing), it is not possible to find out why exactly the file was read, and whether the process reading the file also wrote a copy of the data elsewhere (to USB? to socket? to RAM?).

Moreover, this only concerns online, unprivileged attacks. If I have physical access, I could reboot into a live-CD distro, mount the partition read only, copy anything off it (or even make a full-disk image) and there would be no marks on the partition (except the incremented mount counter).

  • I've done some testing and the "cp" command doesn't update the a/c/m/time :( – polslinux May 14 '12 at 15:16
  • 1
    A copy shouldn't modify create or modify times, that's expected behavior. As for access time: is the partition mounted with noatime or relatime option? That would give the results you describe. (IIRC, many distros mount ext partitions with relatime by default) – Piskvor May 14 '12 at 15:18
  • My home partition is mounted as: UUID=675e8177-c75b-402d-aaea-c0e5ee929a28 /home ext4 defaults,user_xattr 0 2 – polslinux May 14 '12 at 15:30
  • Quoth man mount: "relatime Update inode access times relative to modify or change time. Access time is only updated if the previous access time was earlier than the current modify or change time. Since Linux 2.6.30, the kernel defaults to the behavior provided by this option (unless noatime was specified), and the strictatime option is required to obtain traditional semantics. In addition, since Linux 2.6.30, the file's last access time is always updated if it is more than 1 day old." That's your defaults at work, right there. – Piskvor May 14 '12 at 17:40
  • 1
    Good answer to include mounting the drive as read-only. Seems like you are out of luck @polslinux. Best to secure your files with encrypted containers in this case, matey :-) more info – invert May 15 '12 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.