-3

I have been trying to make a C program to determine if file has been copied or not in C. Originally I thought the modification time would change upon copying the file but it does not. Does anyone have a program I can use for this project? I am using windows 7. Thanks!

user2962762
  • 1
  • 3
  • 3
    There's no way to tell if a file has been copied or not. You're going to need to find a different project. – Ken White Dec 28 '13 at 01:30
  • you really cant tell if a file has been copied. Some file systems keep an access time on there fiels, which would let you know how recently it might have been copied, but access isnt necessarily copying, so you are kind of stuck. – RichardPlunkett Dec 28 '13 at 01:30
  • Copying a file does not modify it. When some app opens a file and starts sequentially reading it, the OS has no idea if that data is then being written somewhere else. – Martin James Dec 28 '13 at 01:41
  • In windows, if your goto a files properties it says filed last accessed right under modified. This changes when I copy it. How do I view this in C? – user2962762 Dec 28 '13 at 02:00
  • You might want to change the wording of the question to "how do I read the last time a file was accessed in Windows" - it more accurately reflects what you are trying to do, right? – Floris Dec 28 '13 at 02:57
  • possible duplicate of [Telling when file was last accessed in C](http://stackoverflow.com/questions/20810533/telling-when-file-was-last-accessed-in-c). I know that the other one was already flagged as a dupe of this, but if the other one is actually more useful, it makes sense to close this one instead. – Dennis Meng Dec 28 '13 at 04:50

1 Answers1

2

Take a look at the getFileTime() function. I think it does exactly what you are asking for. The link gives you code examples. Code signature looks like this:

BOOL WINAPI GetFileTime( In HANDLE hFile, _Out_opt_ LPFILETIME lpCreationTime, _Out_opt_ LPFILETIME lpLastAccessTime, _Out_opt_ LPFILETIME lpLastWriteTime );

Depending on the version of Windows, you need to include the following (quoting from above link):

FileAPI.h (include Windows.h); WinBase.h on Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP (include Windows.h)

I don't have a Windows machine so I can't check this, but you should be able to get the "last accessed" time with this information.

If you really want to know when a file gets copied, use Digital Guardian from Verdasys - http://www.verdasys.com . It is an "enterprise solution" but I know from personal experience that it is very good at doing exactly this. I consider then one of the top solutions for "data leakage prevention".

Floris
  • 45,857
  • 6
  • 70
  • 122
  • Note that _any_ read is an access, whether or not the data was copied elsewhere after being read. As others have said, detecting whether a file has actually been _copied_ is somewhere between difficult and impossible, mostly impossible though with enough work you can catch a few of the most obvious cases. – keshlam Dec 28 '13 at 06:21
  • @keshlam agree with all but your last point. There is a solution available from [Verdasys](https://www.verdasys.com) that actually lives in the BIOS and that can record every file copy operation - it is called Digital Guardian. Rather complex but very powerful. And not a simple C program... – Floris Dec 28 '13 at 13:03
  • That presumes you recognize file copy operations as such. Read, work with for a while, write is not a simple "file copy", especially if the data goes through an intermediate form with a different signature. Ditto breaking it up into smaller chunks which are later reassembled, eg multiple network connections. It is certainly possible to provide some protection and guard against accidental/careless copying. I honestly don't think it's possible to provide complete protection except by blocking reads, or writes, entirely; I think that reduces to the Stopping Problem. – keshlam Dec 28 '13 at 18:57