Somebody read my files: which ones and when?

Discussion in 'privacy general' started by exebbeche, Dec 19, 2005.

Thread Status:
Not open for further replies.
  1. exebbeche

    exebbeche Registered Member

    Joined:
    Jul 1, 2004
    Posts:
    3
    Hi,

    I think –I am sure, actually– that somebody at my workplace has been reading my documents, snooping into my files, etc. I would like to know how they did it, but more importantly, which files they read and when. Is that possible? Is there any procedure I should follow to determine that, any software I could download? My attitude and strategy from now on will change according to that.

    I am not asking about the best way to protect my files, I want to know if I can determine which ones (and when) have been read.

    I have a Dell with a Windows 2000 OS, and though I am the administrator of that computer and several other people are only Power Users, I know they read my files. There’s no network.

    This is a very important issue for me: I would appreciate any answer.
     
  2. Brinn

    Brinn Registered Member

    Joined:
    Aug 5, 2004
    Posts:
    181
    Location:
    Canada
    I'm not sure about the Windows 2000, but in Windows XP, set folder options to Show Hidden Files, then look in:

    c:\Documents and Settings\[user name]\Application Data\Microsoft\Office\Recent

    This folder would contain links to documents that were accessed. The date the link was created is when they were first accessed. This is assuming that the documents were Windows Office apps, that everyone has a unique login ID and that the person responsible didn't clean out all traces of his activities.
     
  3. CrazyM

    CrazyM Firewall Expert

    Joined:
    Feb 9, 2002
    Posts:
    2,428
    Location:
    BC, Canada
    Hi exebbeche

    ... and welcome to Wilders :)

    Can you tell us more on where these documents are saved?
    You mention you are the Administrator of the system, are they in C:\Documents and Settings\Administrator? Anything there should not be accessible by another account. Has your account/password been compromised? What type of logon events are you logging?

    Regards,

    CrazyM
     
  4. tony62

    tony62 Registered Member

    Joined:
    Aug 26, 2005
    Posts:
    214
    Location:
    UK
    Hi exebbeche,
    As Brinn has mentioned, Recent documents would probably give you a good idea as to what has been viewed. If your PC uses only one account then i'd suggest you password protect your account and log off when you are away.
    There is however software which can protect your files which you do not wish anyone to view. One which springs to my mind would be FolderLocker, which you can the easily hide files from view with a password. Another would be to use Encryption, although a bit more of an inconvenience if you frequently modify them IMO.
     
    Last edited: Dec 19, 2005
  5. exebbeche

    exebbeche Registered Member

    Joined:
    Jul 1, 2004
    Posts:
    3
    Hello everybody:

    Thanks a lot for your comments.

    Brinn:

    I am rushing out now (I have to go to work) but I will check this evening and let you know if it worked; yes, they are Word documents mostly, and yes everybody has a unique log in ID, but one possible problem is that this situation has been going on for a long time (maybe a whole year) and I wasn’t aware of it.

    CrazyM:

    Thanks for your welcome. In fact I have been using Wilders’ advice on firewalls, anti-virus software, etc., for quite a while but I guess this is my first posting.

    I am the administrator but log in as a Power User with my own ID, so does everybody else. These files were saved as hidden files in a hidden folder in ‘My Documents’ –in ‘my’ My Documents, not in the Administrator’s. Perhaps my password has been compromised, I can’t tell. I have already changed it. I’m not sure I can follow you when you ask ‘What kind of logon events are you logging?’ –I may not totally illiterate when it comes to computers, but I am by no means an expert, just a user.

    Tony62,

    Thanks a lot, I’ll keep that in mind for the future, now my priority is to determine how much information (from personal stuff to business letters) has leaked into the wrong hands.

    I’ll keep you guys posted, thanks a lot for your help, please keep in touch.

    Exebbeche
     
  6. pcalvert

    pcalvert Registered Member

    Joined:
    May 21, 2005
    Posts:
    203
    You can probably assume that all of them have leaked into the wrong hands. Maybe not, but it seems likely considering how long it has been going on.

    Don't let on that you know. You may be able to figure out who has been doing it by planting fake documents in the same location that you've been storing your documents. You can make it more believable by mixing in genuine documents that you don't care if anyone reads them. Put the documents that you don't want anyone to see in another location and/or protect them with encryption. Even with encryption, I'd be reluctant to leave the files on that computer. I would store the files on a Zip disk or CD-RW disk and take them with me, or lock them in my desk.

    Phil
     
  7. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,696
    Hi,
    The best way is to right-click a file and go to properties. Then, you'll have three dates - created, modified, accessed. You're interested in last accessed. Recently Opened documents lists could be emptied - by using MRUBlaster or CCleaner.
    Mrk
     
  8. Tassie_Devils

    Tassie_Devils Global Moderator

    Joined:
    May 8, 2002
    Posts:
    2,514
    Location:
    State Queensland, Australia
    The only problem with that is the 'Accessed' will only show the actual viewing you are doing on that file at that very moment by *you*, unless I am doing something 'wrong' :doubt:

    I've also wanted to previously check a file when it was last worked on and noticed it giving the actual date and time of the very current viewing by me at that moment. I just looked at 3 files I know have not accessed in over a month and the Accessed was today's date and the actual time I looked at them.

    TAS
     
  9. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,696
    Hi,
    You're right, but here's the correct solution.
    Open explorer.
    Go to any folder.
    Display your data in details
    You will have now categories - name, size, type, date modified.
    Right click near date modified and you can add more categories.
    Date accessed does not show, so go for more.
    Select date accessed and it will show you when the file was last accessed in the list.
    Mrk
     
  10. Tassie_Devils

    Tassie_Devils Global Moderator

    Joined:
    May 8, 2002
    Posts:
    2,514
    Location:
    State Queensland, Australia
    Thanks for that info Mrkvonic...;) that should do nicely. :)

    TAS
     
  11. exebbeche

    exebbeche Registered Member

    Joined:
    Jul 1, 2004
    Posts:
    3
    Who read my files, which ones and when?

    Hello people,

    Thanks to you all for your advice; I am afraid I will need more input, though.

    Dear Brinn,

    I tried what you suggested but unfortunately I only gained access to the last two months of activity of the other users.

    Dear Mrkvonic,

    Unless I have been doing everything the wrong way your solution gives me the last person who saved each document, not the last person who opened it.

    QUESTION:

    I need to know the name of the person who did this, is that possible?

    I feel I bit silly actually. I am the ‘Administrator’ of the computer and not even once did I peek into any file that wasn’t mine. Snooping into other people’s lives –plans, job application letters, business proposals, personal stuff– is wrong, as simple as that.
     
  12. Brinn

    Brinn Registered Member

    Joined:
    Aug 5, 2004
    Posts:
    181
    Location:
    Canada
    It looks you're going to have to hope this person does it again. :doubt:
     
  13. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,696
    Hi,
    The accessed tab will tell you when the file was last time read.
    I'll show you an example - see attached image.
    Look at my windows folder - it was last accessed at 2am, and it wasn't me doing it. Ir was the Microsoft Anti-Spyware doing its scan. Now, MSAS didn't change the files but it did access them, so if you enable the Accessed tab in the explorer, you will know when your files were touched.
    And then, you may start narrowing down who was there at the workplace at which hour. Maybe you can give them 'work', so they stay overtime, one person at a time. Let them close the office after you. And then, check every morning after that if someone browsed your docs.
    And if you want to prevent it, maybe you could try AxCrypt, encryption program.
    Mrk
     

    Attached Files:

  14. Notok

    Notok Registered Member

    Joined:
    May 28, 2004
    Posts:
    2,969
    Location:
    Portland, OR (USA)
    Here you go.. I've never used it, so I can't vouch for it, but it looks like just what you're looking for..
    http://www.snapfiles.com/get/tracksrevealer.html

    I never in a million years thought I'd be saying this, but this actually seems like it might be an appropriate situation for a keylogger <cringes silently> Hopefully you're being truthful about the situation (I have no reason to doubt you, but on the internet you can never be sure). If I were in this situation, I would want to know not only when they accessed those files, but what they were doing with them (emailing them to a competitor? etc..)
    http://www.snapfiles.com/freeware/security/fwaccessmonitoring.html
    The paid software may even do more that would be specifically appropriate to this situation
    http://www.snapfiles.com/Shareware/security/swaccessmonitoring.html

    You might also want to take a look at files that have been deleted..
    Free: http://www.pcinspector.de/file_recovery/uk/welcome.htm
    Paid: http://www.recovermyfiles.com/
     
Loading...
Thread Status:
Not open for further replies.