Preventing information leakage by detecting remains of copied files

Abstract

Portable storage media, such as universal serial bus (USB) ash drives, are used to carry digital data. However, a great deal of data leaks as a result of users forgetting to delete data copied to a personal computer from portable storage media. We propose a technique to detect the remains of copy content files by analyzing the clipboard and directory logs obtained from a personal computer. Our experimental result suggests that the technique can be used to accurately detect files containing copy left behind.