I am using Arch linux. I am wondering if there are log files or other ways to find out if some files has been copied or moved into USB memory stick. I know /var/log keep log files and tested by coping a file into USB stick. But, the following command did not show me anything.

find /var/log -type f | xargs grep 'file name'

Any hint might be helpful. Thanks in advance.

  • Can't you just mount the USB stick and browse it to see? Why/how would the files have been copied? – Time4Tea Nov 8 '17 at 14:00
  • I am thinking about monitoring files which should not be copied unwantedly into memory sticks. – Seong Nov 8 '17 at 14:04
  • Are you suspicious that files may have been copied without your knowledge? If so, why? Are we talking about specific files or just any files in general? – Time4Tea Nov 8 '17 at 14:07
  • First off lets talk about any files in general. Because I am working for a company and some files may be IP protected, So I want to know and be sure if linux server has some kind of way. – Seong Nov 8 '17 at 14:12
  • Have a look at zeitgeist – RubberStamp Nov 8 '17 at 14:30

In general, there are no logs kept persistently by default for operations that are performed as frequently as file copies. If you want them, you need to explicitly opt in using something like auditd, or do it realtime. You can:

  • See who is accessing it in real time using lsof/fuser or similar;
  • Use inotify
  • Set up auditing (take a look at auditd);
  • Use something like LoggedFS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.