Hi:
For an application the requirements state that "audits" must be made to all
important data
so no data "state" or values is lost after updates/deletions (I must be able
to reconstruct the
state of the data at a certain moment).
This application uses the filesystem (NTFS) to store some important files.
With NTFS (or Active Directory shared folders) I have the possibility to
audit all changes
made in a folder. The problem is that the "audits" generated (events in the
event log) are
the operations made ("readData", "writeData", "ReadAttributes",
"WriteAttributes",
"WriteData", and so on) but not the data that is actually written or
changed.
What that means is that I know that the data has been changed an who changed
it but not
exactly *what* has been changed.
Is there a way to audit or "log" all this "modifications" or "states" of the
filesystem or this
is not possible with NTFS or other filesystem? Another option would be to
use a database
but I wouldn't like to modify the application to store this files in the
database.
Thanks for your help. Regards,
Juan Carlos
|