RE: Tracking moved files?

I vaguely remember something about a DLT system in w2k.
It tracks the files for indexing purposes and creates a hidden log file.

I dragged this off the MS site:

"The DLT Client service monitors activity on NTFS volumes and stores
maintenance information in a file called Tracking.log, which is located in a
hidden folder called System Volume Information at the root of each volume.
This folder is protected by permissions that allow only the system to have
access to it. The folder is also used by other Windows services, such as
Indexing Service."

If you could log in as system you may glean something from there.

J


-----Original Message-----
From: MikeMackrill@BC.com [mailto:MikeMackrill@BC.com] 
Sent: Monday, May 08, 2006 3:51 AM
To: filbanks@gmail.com; forensics@securityfocus.com
Subject: Re: Tracking moved files?

Did you check the recent items to look for a reference to the file on the
thumb drive?

All I could think of on a Sunday morning.

Mike Mackrill

-----Original Message-----
From: Serge Jorgensen <filbanks@gmail.com>
To: forensics@securityfocus.com <forensics@securityfocus.com>
Sent: Thu May 04 10:16:08 2006
Subject: Tracking moved files?

Hello!

I'm try to show that files were copied and/or moved off a W2K drive
onto a USB stick. Obviously the registry and setupapi files show the
USB installation info - but I can't find the log file (or other
method?) that Windows must use to track files being moved and copied.

I don't have the USB device - which would make this a whole lot easier.

Any ideas would be great.

Thanks.

George