Directory watching

[Andrew Glen-Young]

On 16/10/2007, Bart Silverstrim <bsilver at chrononomicon.com> wrote:
>
> It appears that rdiff-backup should work.  I think I have it configured
> for what I'm looking for...
>
> Basically I have a user where they save files then they are magically
> disappearing from his home directory (on Windows) at some point in the
> day and I'm trying to monitor (and restore) the files to find the point
> at which they're disappearing to find out who or what is doing it, since
> it's odd that they are there, he saves, he goes to another lab later and
> *blink* they're gone and it's just his directory being affected.
> Rdiff-backup with the listing of increment changes looks like it'll tell
> me approximately when it occurs, since I'm running it every five minutes
> from Crond.
>

Awesome! Glad to hear it - you could get fancy with and use 'incron'
if feel it necessary.
I haven't used it myself, but it should allow you to pin-point the
exact time the files "disappear".

I would also check his drive mapping and whether his anti-virus is
placing the files in quarintine. Modifying the Windows Local Policy
settings to audit file modification might also help - but is a little
too verbose. You didn't hear any MS advice from me on this list ;-)

- A.