Tracking file movement in a network environment
File access in a network environment by detecting when files have been accessed at a computers in the network environment, and then generating unique content identifiers of the file content. The content identifier along with access metadata can be transmitted to and stored at a central location. The stored information can be used to track file content movement in the network environment.
1. A method for use in tracking file movement in a network environment, the method comprising:
at a host computing device on the network, detecting that a file has been accessed;
at the host computing device, cause a unique content identifier for the file to be generated from at least a portion of the file;
transmitting to centralized storage the generated content identifier and file access activity of accessing the file; and
generating at the centralized storage a notification that the file associated with the generated content identifier and the file access activity has been improperly accessed,
wherein the unique content identifier comprises a file fingerprint including one or more hashes generated according to a read profile for the file, the read profile comprising a nominal number of probe, stripe and block hash passes for fingerprinting the at least a portion of the file.
2. The method of claim 1 , wherein causing the unique content identifier to be generated comprises adding the file to a list of files to be fingerprinted.
3. The method of claim 1 , wherein the file access activity comprises information that may be useful in a forensic analysis of file access for the file.
4. The method of claim 1 , wherein the file access activity comprises one or more of: a time the file was accessed; a user that accessed the file; a location the file was accessed from; an application used in accessing the file; and a computer host used to access the file.
5. The method of claim 1 , further comprising: receiving at the centralized storage the transmitted content identifier and file access activity of accessing the file; and storing at the centralized storage the received content identifier in association with the received file access activity.
6. The method of claim 5 , wherein the centralized storage receives and stores a plurality of content identifiers and associated file access activity.
7. The method of claim 1 , wherein the nominal number of hash probe, stripe and block passes are provided for fingerprinting the entire file.
8. A device for use in tracking file movement in a network environment, the device comprising:
a processor capable of executing instructions; and
a memory storing instructions, which when executed by the processor configure the device to:
detect that a file has been accessed;
cause a unique content identifier for the file to be generated from at least a portion of the file;
transmit to centralized storage the generated content identifier and file access activity of accessing the file; and
generate at the centralized storage, a notification that the file associated with the generated content identifier and the file access activity has been improperly accessed,
wherein the unique content identifier comprises a file fingerprint including one or more hashes generated according to a read profile for the file, the read profile comprising a nominal number of probe, stripe and block hash passes for fingerprinting the at least a portion of the file.
9. The device of claim 8 , wherein causing the unique content identifier to be generated comprises adding the file to a list of files to be fingerprinted.
10. The device of claim 8 , wherein the file access activity comprises information that may be useful in a forensic analysis of file access for the file.
11. The device of claim 8 , wherein the file access activity comprises one or more of: a time the file was accessed; a user that accessed the file; a location the file was accessed from; an application used in accessing the file; and a computer host used to access the file.
12. The device of claim 8 , wherein the centralized storage receives and stores a plurality of content identifiers and associated file access activity.
13. The device of claim 8 , wherein the nominal number of hash probe, stripe and block passes are provided for fingerprinting the entire file.
14. A system for tracking file movement in a network environment, the system comprising:
a plurality of devices, each device comprising:
a processor capable of executing instructions; and
a memory storing instructions, which when executed by the processor configure the device to:
detect that a file has been accessed;
cause a unique content identifier for the file to be generated from at least a portion of the file; and
transmit to centralized storage the generated content identifier and access activity of accessing the file;
the centralized storage comprising:
a processor capable of executing instructions; and
a memory storing instructions,
which when executed by the processor configure the centralized storage to:
receive the transmitted content identifier and the file access activity of accessing the file;
store the received content identifier in association with the received file access activity; and
generate a notification that the file associated with the generated content identifier and file access activity has been improperly accessed,
wherein the unique content identifier comprises a file fingerprint including one or more hashes generated according to a read profile for the file, the read profile comprising a nominal number of probe, stripe and block hash passes for fingerprinting the at least a portion of the file.
15. The system of claim 14 , wherein the centralized storage receives and stores a plurality of content identifiers and associated file access activity.
16. The system of claim 14 , wherein causing the unique content identifier to be generated comprises adding the file to a list of files to be fingerprinted.
17. The system of claim 14 , wherein the file access activity comprises information that may be useful in a forensic analysis of file access for the file.
18. The system of claim 14 , wherein the file access activity comprises one or more of: a time the file was accessed; a user that accessed the file; a location the file was accessed from; an application used in accessing the file; and a computer host used to access the file.
19. The system of claim 14 , wherein the nominal number of hash probe, stripe and block passes are provided for fingerprinting the entire file.