Method and system for shadowing accesses to removable medium storage devices
View Patent ↗A method and device monitor usage of external storage media. The method and system selectively shadow I/O (input/output) from/to only external storage media. The method selectively shadows only accesses to external storage media connected to a computer. The method detects a data access to an external storage medium and writes a copy of the accessed data to a storage location other than the external storage medium. In one embodiment, the access is a write operation. In one embodiment, the method intercepts an I/O request from the computer to an external storage media drive in which the external storage media is inserted. In the case of the Windows NT or Windows 2000 operating systems, the intercepted I/O requests are preferably IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE and IRP_MJ_FILE_SYSTEM_CONTROL packets. An apparatus comprises a detector and a storage connected to the detector. The detector receives I/O requests to an external storage medium. The storage is one other than the external storage medium. Written in the storage is a copy of the accessed data. In one embodiment, the apparatus further comprises one or more proxy handlers connected to the detector, wherein the proxy handlers handle certain I/O requests, which, in the case of the Windows NT or Windows NT operating system, include IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE and IRP_MJ_FILE_SYSTEM_CONTROL packets.
1. A method for selectively shadowing only accesses to external storage media connected to a computer, the method comprising: detecting a data access to an external storage medium; and writing a copy of the accessed data to a storage location other than the external storage medium, the storage location is a protected storage location; wherein the detecting step comprises intercepting an I/O request from the computer to an external storage media drive in which the external storage media is inserted.
2. The method of claim 1 wherein the access is a write operation.
3. The method of claim 1 wherein the access is a read operation.
4. The method of claim 1 wherein the I/O request is one of the group consisting of a file open or creation request, a write request, a file close request, a file system control request and a read request.
5. The method of claim 4 further comprising:
providing a proxy handler for the I/O request; and executing the proxy handler, in response to the detecting step.
6. The method of claim 1 wherein the computer runs under an operating system and the I/O request is one of the group consisting of IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE, IRP_MJ_FILE_SYSTEM_CONTROL and IRP_MJ_READ packets.
7. The method of claim 6 further comprising:
providing proxy handlers for the IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE and IRP_MJ_FILE_SYSTEM_CONT- ROL packets; and executing one of the proxy handlers, in response to the detecting step when the I/O request is a respective packet selected from the group consisting of IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE and IRP_MJ_FILE_SYSTEM_CONTROL packets.
8. The method of claim 7 further comprising:
providing a proxy handlers for the IRP_MJ_READ packet; and executing the proxy handlers for the IRP_MJ_READ packet, in response to the detecting step when the I/O request is an IRP_MJ_READ packet.
9. The method of claim 1 further comprising:
writing the data to the external storage medium after the step of writing a copy of the data to a storage location other than the external storage medium.
10. The method of claim 1 further comprising:
attaching to one or more file systems connected to an external storage media drive in which the external storage medium is inserted; and wherein the detecting step comprises intercepting JIG requests to the one or more file systems.
11. The method of claim 1 wherein the external storage medium is selected from the group consisting of a floppy disk; a CD, a removable hard disk drive, and a zip disk drive.
12. The method of claim 1 further comprising: collecting the copy into a database where similar copies are collected; and querying the database.
13. The method of claim 12 wherein the computer is connected to a computer network, and the detecting and copying steps are performed at the computer, and the collecting and querying steps are performed at another computer on the network.
14. The method of claim 12 wherein the collecting and querying steps are performed by a user with administrator privileges.
15. The method of claim 1 wherein the external storage medium is selected from the group consisting of a floppy disk; a writable CD, a removable hard disk drive, and a zip disk drive.
16. A method for selectively shadowingg only acesses to external storage media connected to a computer, the method comprising:
detecting a data access to an external storage medium;
writing a copy of the accessed data to a storage location other than the external storage medium;
collecting the copy into a database where similar copies are collected; and
querying the database;
wherein the detecting step comprises intercepting an I/O request from yhe computer to an external storage media drive in which the external storage media is inserted;
wherein the database comprises records, each record comprising the copied data, file name associated with the data, an indentification of who initiated the data access, a station ID, and when the access was made.
17. A computer readable storage medium on which is embedded computer software, the software performing a method, the method comprising:
detecting a data access to an external storage medium; and writing a copy of the accessed data to a storage location other than the external storage medium, the storage location is a protected storage location; wherein the detecting step comprises intercepting an I/O request from the computer to an external storage media drive in which the external storage media is inserted.
18. The computer readable storage medium of claim 17 wherein the access is a write operation.
19. The computer readable storage medium of claim 17 wherein the computer system runs under an operating system and the I/O request is one of the group consisting of IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE, IRP_MJ_FILE_SYSTEM_CONTROL and IRP_MJ_READ packets.
20. The computer readable storage medium of claim 17 wherein the external storage medium is selected from the group consisting of a floppy disk; a writable CD, a removable hard disk drive, and a zip disk drive.
21. An apparatus for selectively shadowing only accesses to external storage media connected to a computer, the apparatus comprising: a detector that intercepts I/O requests from the computer to an external storage media drive in which the external storage media is inserted; and a storage location, that is a protected storage location, other than the external storage medium, connected to the detector, in which a copy of the accessed data is written.
22. The apparatus of claim 21 further comprising one or more proxy handlers connected to the detector, wherein the proxy handlers handle certain I/O requests.
23. The apparatus of claim 22 wherein the certain I/O requests comprise IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE and IRP_MJ_FILE_SYSTEM_CONTROL packet.
24. The apparatus of claim 23 wherein the certain I/O requests further comprise an IRP_MJ_READ packet.
25. The apparatus of claim 22 further comprising: a list, connected to at least some of the one or more proxy handlers, in which file identifiers are contained.
26. The apparatus of claim 25 wherein the file identifiers are IRP.FsContext values.
27. The apparatus of claim 22 further comprising: one or more counters , connected to at least some of the one or more proxy handlers, by which certain file operations are counted.
28. The apparatus of claim 22 wherein the computer runs under an operating system, and the one or more proxy handlers are connected to I/O request packet drivers supplied by the operating system.
29. The apparatus of claim 21 wherein the external storage medium is selected from the group consisting of a floppy disk; a writable CD, a removable hard disk drive, and a zip disk drive.