How do I track file copying?

There's no such file system operation as file copying. The copy operation involves: file_open_for_reading, file_open_for_writing, read, write, and two file_close operations. You can track each operation separately and try to detect their combination. But, remember that the copying of data can also be done by compressing or encrypting the data in memory and writing the compressed or encrypted data to the destination.

Ready to get started?

Learn more about Callback Technologies or download a free trial.

Download Now