The captain of the team leader specifically ordered that the Prime Minister was not in a good mood these days, and someone wanted to assassinate him last night, but the Prime Minister was killed in a very good manner, so we were both energetic and we must act carefully.

Network administrator Xiaojia / sysadm.cc

It has not been peaceful at night recently, but I didn’t expect that it was Xiao Liuzi and I tonight again.

The captain of the former team leader specially ordered that the Prime Minister was not in a good mood these days, and someone wanted to assassinate him last night, but the Chief was killed in a very good manner, so we were both energetic and we must act carefully.

Finally got through the night in the first half of the night, and thought nothing should be done, but I didn't expect to see the fourth update in the next half of the night, and there was a sudden movement in the room.

Xiao Liuzi and I were all in my throat!

"Come on, come on! Someone touched my U disk!"

Oh my god, our souls were flying, I lowered my voice to greet Xiao Liuzi, why is there no one? I glanced at it, okay, this kid had already foamed at the ground and was unconscious.

has no tricks, so I had to go into the house alone with trembling teeth.

"Chen...Chen...Prince! Please...Please...Please give me instructions!" I said with courage.

"splash", something flew over and shook me on my face, shuddering me.

I covered my face and almost peed. I quickly knelt on the ground. Then I realized that the thing seemed to be a U disk.

"It must be those old men who copied all my sisters while I was away! Wow, ah... Check me if someone copied my files!"

At this time, I was already in tears and couldn't move. I regretted doing this life-threatening job in my heart. I thought to myself, Prime Minister, where can I help you investigate this case!

Seeing that I did not respond, the prime minister pulled out his sword in anger and put it on the edge of my neck.

I just felt the top of me take a breath of cold air, and there was a warm current below, and I kicked hard. Somehow I just heard the sound of "Duang" and fell heavily...

When I struggled to get up, I realized that I had a messy dream.

I let out a long sigh and after I cleaned up myself, I suddenly recalled the strange problem in my dream: How do you know that someone has copied the files in the U disk!

OK? What a problem? This is a waste of sleepiness after such a toss. Why don’t you just study it?

A seemingly simple problem resulted in me for several days.

I searched all over the mountains and five mountains, and the five lakes and the world, and I just found Guanshiyin Bodhisattva. Finally, I concluded that the system does not record the U disk copying action, so I can't know if anyone has copied the file.

So is that really the end?

analysis and research

You see, if you copy files from the computer to the U disk, then at least there are access records to follow on the computer.

For example, Recently visited You will see which files have been accessed.

Even if you clear these traces, you can still find some clues. Do you know where the program usage records secretly kept by the system? There is a detailed introduction in 》.

But now the problem is different. Just a bare U disk, there is no computer, at most it only has its own computer.

If others take you U You don’t need to copy things on your own computer, and it’s even more impossible for us to see if other people’s computers have any traces left.

"Hello! Lao Jia, look at your computer, I suspect you are secretly copying my files."

said this and must have been broken by someone!

This doesn’t work, then that doesn’t work, is there really no chance?

in different partition formats, we think so. If you copy the file, you must have moved the file, so there will be some changes.

After I tested it for a while, I found that the access time of the file will change.

sometimes has a relationship with the partition format of the U disk. The specific analysis is as follows. In the format of

FAT/FAT32, even if you do not open or operate this file, even if you simply view the file attributes, the file access time will change.

Let’s just find a file on the disk. Let’s try it. Right-click the property for the first time. The access time is like this.

Have you seen it clearly?

OK, close this property window, and then do nothing else, and it's still the file, right-click to open the file properties again.

Look at it, its access time immediately becomes the latest time!

OK, let’s take a look at the NTFS format.

is the same as before, and only observes the changes in access time by viewing the file attributes.

The first time I check the file attributes, confirming that the access time is old.

OK, close the properties window and check the access time in the properties again.

OK, it was updated without doing anything!

After comparison, we can clearly see that in the NTFS partition format, not only has the same file access time as FAT/FAT32 partition format, but also has a detailed time, minute and second.

, it is worthy of being NTFS!

Well, FAT/FAT32/NTFS These fickle guys have just experienced it. However, under normal circumstances, U disk also has a partition format exFAT. What will happen to it? How do you know if you don’t try

? Come on, do the previous test method again.

The first time you check the attribute, the access time is confirmed to be old, no problem.

OK, open the attribute again to check the access time... Alas... Why hasn't it changed?

Is it a dazzling or is there any error in the operation?

is actually no problem. This exFAT is completely different from the previous ones. Its principle is that as long as you don’t move it, it won’t move around, and even if you check the attributes, it will be harmless.

Of course, there is another small detail here, that is, exFAT is the same as FAT/FAT32, the file access time does not have a specific time, minute and second. The partition formats analyzed above

are at least commonly used partition formats for mobile devices such as WindowsU disks. As for the partition formats supported by systems such as Linux or MacOSMacOS will be published for research.

is OK. So far, we can draw a conclusion temporarily, that is, the access time of the FAT/FAT32/NTFS disk in the format of UU will definitely change after the file is copied.

Even if no special operations are done but just viewing the file attributes, the system will update the access time attributes of the current file.

However, exFAT 3 partition format, no matter how you do it, you can't see any changes.

So after we draw the above conclusion, we can make some choices about how to actually use and protect U disk information.

For example, try to format the U disk into NTFS format. The current U disk has relatively large capacity and fully supports the NTFS format. The format of

can make the access time accurate to time, minutes and seconds, which is more conducive to us to determine whether the file has been moved by others.

, and usually U The default partition format of the disk is FAT/FAT32, so in this format, the file access time can only be accurate to the date, and if the file is copied on the same day, it cannot be judged.

The last and most rigid one is the exFAT format. Not only does the date not be more accurate, but its access has not changed at all times and cannot play a judgment role.

However, things are not that simple

Speaking of this, some friends may find a BUG.

If you suspect that someone has copied their own file, then once I check the properties of the file, will it change again?

In order to prevent the file access time from being refreshed for no reason, is there any way to see the actual file access time without clicking on the attribute?

For this reason, I made a small program myself (downloaded at the end of the article). Viewing through the program will not affect the change in access time.

For example, the FAT32 disk in the format of can batch view the various times of the files inside, including creation time, modification time and access time.

Then format it into NTFS format try.

access time is accurate to time, minutes and seconds, which is great!

Even if you use a terminal program to copy a file, it will change the access time of the file.

don’t believe it? Let's try it.

For example, copy the U disk X:\path\foo.xxx file to C:\.

copy X:\path\foo.xxx C:\

Before copying:

After copying:

Homemade tool download

Network administrator Xiao Jia's file Property Viewer

XJFileProperty.7z(43K)

Download link: https://pan.baidu.com/s/1c4N4M8u_UXd7E3GviIBjCQ

Extraction code: Follow the official account and send 000991

is written at the end

Although it is now an era of popular network disks, some documents, especially very important materials, are not necessarily suitable for storage on network disks.

Once the network disk is hung, you can only cry without tears, and everything will be wasted!

Therefore, many friends must choose to store it in their mobile devices, which are easy to use and can be stored and retrieved at any time.

, but it also brings certain safety hazards, which are prone to loss or leakage of information. Therefore, this article also provides you with a method that is not a solution to help you deal with some actual situations.

is obvious. The method in this article is just a passive method. When someone copys the file, the information has been leaked, so the best protection solution is encryption.

The simplest encryption solution can be used with Bitlocker. Interested friends can try it.

If there are many likes, I will also take the time to write a special article on U disk using Bitlocker.

OK, follow me, follow me, follow me!

PS: Some friends suggested that according to the article, the file access time will not be updated as expected in the format of NTFS) of the file access time (Last Access Time).

Later I tried it again, and it was really strange that the same thing happened here.

You should know that I have screenshots in the article to testify. The access time has obviously changed, why is it not working now?

So I went to search for information again. I always have to have a fixed conclusion to give my friends an explanation!

Fortunately, I found it in the end!

You can refer to Microsoft official article "How does NTFS work".

http://technet.microsoft.com/en-us/library/cc781134(WS.10).aspx

The article has too much content, I'll give you a brief summary.

updates access time, in fact, NTFS is designed like this.

In order to avoid performance problems caused by frequent disk read and write operations, the access time of file will be updated for one hour .

That is to say, for example, the last time your file was 9:00 , then before 10:00 that morning (for example, 9:59 ) check its properties or copy it, its access time will not be updated.

Once more than one hour (for example, 10:01), its access time will be immediately updated to the current time.

and this update time is very accurate. Not updating does not mean it is inaccurate, because this access time is only temporarily in memory.

Let’s say it again, NTFS There is such a design BUG exists, so I can only express my deep regret.

When it really happens that someone else copies their own files, we will only know at least an hour after the incident!

Haha, if you say that, have those friends with important information, have you decided to pay attention? Please be sure to keep your things under control!

is OK, and the strange knowledge has increased again. Friends can try it out, it’s a very interesting experience!

Finally, don’t forget to like, forward and follow!

Integrate technology into life and create interesting stories

Network administrator Xiaojia / sysadm.cc