Check if a file has been changed
I've posted this question also on stackoverflow
(http://stackoverflow.com/questions/18351131/check-if-a-file-has-been-changed)
and
(http://security.stackexchange.com/questions/40964/check-if-a-file-has-been-changed),
and re-post it here again because a user mentioned that I may have better
luck here.
Ok I have the following scenario:
A certain process (A) creates files and I want to write a program which
reads these files to generate some statistical data.
The problem is simple. I want to be sure that the files created by (A)
haven't been corrupted/faked. So the only one who is allowed to
change/modify/create those files is (A). If any other process changed some
of the files or creates similar files I want to detect this and mark these
file as faked/corrupted. I need to be absolutely sure that these files
haven't been changed in any way by another process than (A).
The process (A) is only running on windows system. More specifically
windows xp or above.
Is this even possible? Is it enough to watch the filesystem or do I have
to inject in some way (A) to get the output data before it's stored in a
file?
No comments:
Post a Comment