How can i find if someone transferring data to usb storage devices ?

Question

0.00/5 (No votes)

See more:

I am planning to develop a security application in which the user cannot transfer the data to the USB storage devices without admins permission. For that need to know how can I detect the writing process over the USB.

What I have tried:

Currently i wrote the code to detect the usb and am stuck on finding the data transfer to the USB

C#

protected override void OnStart(string[] args)
{
    //add this line to text file during start of service
    TraceService("start service");

    //handle Elapsed event
    timer.Elapsed += new ElapsedEventHandler(OnElapsedTime);

    //This statement is used to set interval to 1 minute (= 60,000 milliseconds)

    timer.Interval = 10000;

    //enabling the timer
    timer.Enabled = true;
    ManagementEventWatcher mwe_creation;
    WqlEventQuery q_creation = new WqlEventQuery();
    q_creation.EventClassName = "__InstanceCreationEvent";
    q_creation.WithinInterval = new TimeSpan(0, 0, 2);    //How often do you want to check it? 2Sec.
    q_creation.Condition = @"TargetInstance ISA 'Win32_DiskDriveToDiskPartition'";
    mwe_creation = new ManagementEventWatcher(q_creation);
    mwe_creation.EventArrived += new EventArrivedEventHandler(USBEventArrived_Creation);
    mwe_creation.Start();

    ManagementEventWatcher mwe_deletion;
    WqlEventQuery q_deletion = new WqlEventQuery();
    q_deletion.EventClassName = "__InstanceDeletionEvent";
    q_deletion.WithinInterval = new TimeSpan(0, 0, 2);    //How often do you want to check it? 2Sec.
    q_deletion.Condition = @"TargetInstance ISA 'Win32_DiskDriveToDiskPartition'  ";
    mwe_deletion = new ManagementEventWatcher(q_deletion);
    mwe_deletion.EventArrived += new EventArrivedEventHandler(USBEventArrived_Deletion);
    mwe_deletion.Start();

}


internal void USBEventArrived_Creation(object sender, EventArrivedEventArgs e)
{
    TraceService("USB Added");
}

internal void USBEventArrived_Deletion(object sender, EventArrivedEventArgs e)
{
    TraceService("USB Removed");
}

Posted 29-Feb-16 20:23pm

Sarath_S

Updated 29-Feb-16 22:09pm

Kenneth Haugland

v2

Add a Solution

Comments

Sinisa Hajnal 1-Mar-16 3:01am

Why not just disable the usb port? Or is it that you want to allow read of the memory, but nothing else?

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Sreekanth Mothukuru · Answer 1 · 2016-02-29T21:38:00

Solution 1

In this scenario, try implementing the "FileSystemWatcher" class with the "NotifyFilter" set to the changes you wanted to watch out for..

Try the following samples:
C# Corner : Error Display[^]

How to implement a simple filewatcher Windows service in C#[^]

Posted 29-Feb-16 21:38pm

Sreekanth Mothukuru

Thomas Nielsen - getCore · Answer 2 · 2016-02-29T22:09:00

If you want to disable writing to USB altogether there is an excellent article here:
Developing a USB Storage Device Protection Tool with C#[^]

Another approach is to detect the USB drive being mounted and then keep track of it, there is a complexity though, that external harddrives does not register like the usb flash drives, but essentially keeping track of attached devices can be done like this

C#

using System;
using System.IO;
using System.Linq;
using System.Management;
using System.Threading;

namespace UsbDetector
{
    class Program
    {
        private static bool clear;
        static void Main(string[] args)
        {
            Console.WriteLine("Monitoring for DeviceAttaced event");
            clear = false;
            using (var watcher = new ManagementEventWatcher())
            {
                WqlEventQuery query = new WqlEventQuery("SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2");
                watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived);
                watcher.Query = query;
                watcher.Start();
                watcher.WaitForNextEvent();
                while (!clear)
                {
                    Console.WriteLine("Waiting for method clear signal");
                    Thread.Sleep(1000);
                }
            }
            Console.WriteLine("Exitting");
        }

        public static void watcher_EventArrived(object sender, EventArrivedEventArgs e)
        {
            Console.WriteLine("Drive mounted " + e.NewEvent.Properties["DriveName"].Value);
            var driveInfo = DriveInfo.GetDrives().FirstOrDefault(d => d.Name == e.NewEvent.Properties["DriveName"].Value.ToString() + "\\");
            if(driveInfo.DriveType == DriveType.Fixed)
            {
                Console.WriteLine("Drive is a Fixed type, could be an external harddisk connected via USB");
            }
            if(driveInfo.DriveType == DriveType.Removable)
            {
                Console.WriteLine("Drive type is Removeable, could be a USB flash drive");
            }
            clear = true;
        }
    }
}