File system event tracking
View Patent ↗Automated file system event tracking and reporting techniques are described in which file system events requested by a user application are intercepted and recorded prior to the request being permitted to pass to the file system for execution. Similarly, file system responses to a prior captured file system event are also intercepted and recorded. Predefined patterns of file system event may be aggregated and reported as a single event.
1. A file system tracking method, comprising:
intercepting by a processor a file system security change request directed to a target file system object, the target file system object having a current security state, the security change request specifying a final security state;
recording the current security state in a memory;
communicating by the processor the security change request to a file system;
intercepting by the processor an indication that the security change request has been processed by the file system; and
recording the final security state in the memory,
wherein the target file system object is a file directory, the act of recording the current security state and the final security state further comprises recording a current security state and a final security state of a second file system object, wherein the second file system object is within the target file system object.
2. The method of claim 1 , wherein the acts of intercepting are performed by a kernel-level application.
3. The method of claim 1 , wherein the security change request comprises a IRP_MJ_SET_SECURITY request, wherein the IRP_MJ_SET_SECURITY request is a file system security change event request provided by a computer operating system.
4. The method of claim 1 , wherein the act of recording the final security state comprises recording in the memory a single datum from which both the current security state and final security state may be derived.
5. The method of claim 1 , wherein the act of recording the current security state comprises storing the current security state and an identifier identifying the second file system object in a kernel memory.
6. The method of claim 5 , wherein the act of recording the final security state comprises associating the final security state with the current security state in the kernel memory.
7. The method of claim 6 , further comprising:
retrieving, by the processor, the current security state, the target security state and the identifier identifying the target file system object from the kernel buffer memory; and
storing the current security state, the target security state and the identifier identifying the target file system object in a database.
8. The method of claim 7 , wherein the act of retrieving and storing is performed by a user-level application.
9. The method of claim 1 , wherein the act of recording the current security state and the final security state further comprises recording a time associated with the intercepted file system security change request.
10. The method of claim 1 , wherein the act of recording the current security state and the final security state further comprises recording a user account identifier associated with the security change request.
11. The method of claim 1 , wherein the act of recording the current security state and the final security state further comprises recording a process identifier associated with the security change request.
12. The method of claim 1 , wherein the act of recording the current security state and the final security state further comprises recording a computer system identifier on which the target file system object is stored.
13. The method of claim 1 , wherein the act of recording the current security state and the final security state further comprises recording a path associated with the target file system object.
14. The method of claim 1 , wherein the second file system object is a file directory.
15. A program storage device, readable by a programmable control device, comprising instructions stored on the program storage device for causing the programmable control device to perform the method of claim 1 .