RE: file logging

"Howe, Paul H" <[email protected]> Thu, 19 Jul 2007 19:38:57 -0500
Newsgroups gmane.comp.security.forensics
Message-ID <[email protected]>
Or e-mailed them, or scanned them on the copier that scans to PDF e-mail
-> his hot mail account. 

-----Original Message-----
From: [email protected] [mailto:[email protected]]
On Behalf Of [email protected]
Sent: Wednesday, July 18, 2007 9:58 AM
To: [email protected]
Subject: file logging

I have object access auditing turn on, on the windows 2003 file server,
but a common question that comes up when some one has left the firm, is,
"what did he take with him?"



so my question is, how can i determine if the client copied files from
the network to his pc, and secondly did the client copy files from the
network or pc to a usb stick, or burn them to a cd-rom?