Re: How to block system copy commands at driver level

At driver level, you cannot distinguish the copy from the new file
creation.

The idea is futile.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@xxxxxxxxxxxxxxxx
http://www.storagecraft.com

"Bipin Mistry" <bpnmistry@xxxxxxxxx> wrote in message
news:6a3688db-4c57-4671-a27c-30043ef6aa32@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hello,

How can I trace following System Copy commands and block them, so as
secured folder/drive do not react to these commands.

1. [Ctrl + C],
2. Right Click Menu -> Copy
3. File Menu -> Copy
4. Command prompt copy

As per me all above command will be calling a single rutine process at
driver level.
I am unable to identify which rutine dose it call & how can I identify
that the any of above 4 are triggered.

During my RnD till now I reached till IRP_MJ_READ & WRITE where by
related parameters and their properties do not describe about COPY in
specifically.

Some place I read about this can be posible with keeping watch on
Clipboard, dont know how much this will be useful, as there was no
extra informaiton was provided.

If any one can help me out for this situation then please do share
your knowledge with me.

Best regards,
Bipin

.

Relevant Pages

  • Re: How to block system copy commands at driver level
    ... environment is a problem how to limit sensitive information leak. ... If unapproved storage is accessible, there are other ways to move sensitive information there, other than copy. ... driver level there is only File READ / WRITE commands. ... If it is not at driver level then I / We need to search out as to what ...
    (microsoft.public.development.device.drivers)
  • Re: How to block system copy commands at driver level
    ... the token will prohibit writes to all other drives. ... we have been asked to do user based accessibility enhancement of ... If we can not make any work arround for "Copy" in driver level, ... driver level there is only File READ / WRITE commands. ...
    (microsoft.public.development.device.drivers)
  • Re: How to block system copy commands at driver level
    ... This file is an arkived by Client end technology. ... If we can not make any work arround for "Copy" in driver level, ... and selectively limit sensitive information movement. ... driver level there is only File READ / WRITE commands. ...
    (microsoft.public.development.device.drivers)
  • Re: How to block system copy commands at driver level
    ... it sends this data ot your filter. ... driver level there is only File READ / WRITE commands. ... Clipboard, dont know how much this will be useful, as there was no ...
    (microsoft.public.development.device.drivers)
  • Re: How to block system copy commands at driver level
    ... won't permit any form of 'copying' and using SmartCards to control ... and selectively limit sensitive information movement. ... driver level there is only File READ / WRITE commands. ... If it is not at driver level then I / We need to search out as to what ...
    (microsoft.public.development.device.drivers)
Loading