ubuntu lnk files fo...
 
Notifications
Clear all

ubuntu lnk files for usb access

3 Posts
3 Users
0 Likes
429 Views
(@tom-vargas)
Posts: 3
New Member
Topic starter
 

Hi,
I know, in Windows 7/10, when files are copied to a USB/external hard drive and one of those files is accessed, it creates a lnk file on the hard drive, which could help detect file copy.

Are there similar lnk files formed in ubuntu, when a file is accessed on a usb flash drive/external hard drive?
Or is there any other mechanism on ubuntu that serves as evidence when files are copied to external hard drive/usb flash drive?

Thanks
Tom

 
Posted : 01/03/2019 7:27 am
(@jerryw)
Posts: 56
Trusted Member
 

I did have some luck with the file '.recently-used.xbel'. To be able to view in a Windows environment meant copying out text and saving as xml. The file contained the path and added/modified/visited time and date vales. I'm sure there are better ways.

 
Posted : 01/03/2019 7:52 am
minime2k9
(@minime2k9)
Posts: 481
Honorable Member
 

Tom,

Have a look at GVFS metadata, as long as the file was accessed by software that uses the metadata system (most GNOME software) then it may be recorded

https://cyberforensicator.com/wp-content/uploads/2018/04/GVFS-metadata-Shellbags-for-Linux.pdf

There is source code at then end on github to decode the data files, but if you are struggling let me know.

 
Posted : 04/03/2019 8:08 am
Share: