Method and system for shadowing accesses to removable medium storage devices
View Patent ↗A method and device monitor usage of external storage media. The method and system selectively shadow I/O (input/output) from/to only external storage media. The method selectively shadows only accesses to external storage media connected to a computer. The method detects a data access to an external storage medium and writes a copy of the accessed data to a storage location other than the external storage medium. In one embodiment, the access is a write operation. In one embodiment, the method intercepts an I/O request from the computer to an external storage media drive in which the external storage media is inserted. In the case of the Windows NT or Windows 2000 operating systems, the intercepted I/O requests are preferably IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE and IRP_MJ_FILE_SYSTEM_CONTROL packets. An apparatus comprises a detector and a storage connected to the detector. The detector receives I/O requests to an external storage medium. The storage is one other than the external storage medium. Written in the storage is a copy of the accessed data. In one embodiment, the apparatus further comprises one or more proxy handlers connected to the detector, wherein the proxy handlers handle certain I/O requests, which, in the case of the Windows NT or Windows NT operating system, include IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE and IRP_MJ_FILE_SYSTEM_CONTROL packets.
1. A method comprising:
detecting a data access from a computer to an external storage medium, wherein the external storage medium is locally connected to the computer;
writing a copy of the accessed data to a storage location other than the external storage medium;
intercepting an I/O request from the computer to an external storage media drive in which the external storage medium is inserted; and
associating tracking information about the accessed data with the copy of the accessed data, wherein the tracking information comprises a combination of one or more of the following: user, station, time, and type of file.
2. A method comprising:
detecting a data access from a computer to an external storage medium, wherein the external storage medium is locally connected to the computer;
writing a copy of the accessed data to a storage location other than the external storage medium, wherein the storage location other than the external storage medium is a protected storage location; and
associating tracking information about the accessed data with the copy of the accessed data, wherein the tracking information comprises a combination of one or more of the following: user, station, time, and type of file.
3. A non-transitory computer readable storage medium on which is embedded computer software, the software performing a method, the method comprising:
detecting a data access from a computer to an external storage medium, wherein the external storage medium is locally connected to the computer;
writing a copy of the accessed data to a storage location other than the external storage medium;
intercepting an I/O request from the computer to an external storage media drive in which the external storage medium is inserted; and
associating tracking information about the accessed data with the copy of the accessed data, wherein the tracking information comprises a combination of one or more of the following: user, station, time, and type of file.
4. An apparatus comprising:
a detector that receives I/O requests from a computer to an external storage medium, wherein the external storage medium is locally connected to the computer;
a storage, other than the external storage medium, connected to the detector, in which are written: a copy of the accessed data and tracking information about the accessed data, wherein the tracking information comprises a combination of one or more of the following: user, station, time, and type of file; and
one or more proxy handlers connected to the detector, wherein the proxy handlers handle certain of the I/O requests.