File module

Purpose

The File module records all files that are opened on the target computer. It can also be capture the file when opened.

Operating systems

Desktop: Windows, OS X

Significant data

Data is described below:

Field Description

Include Filters

List of file extensions to be recorded. Optionally specify the process to log the file when it is run or opened by that process.

Exclude filters

List of file extensions that will not be recorded. Optionally specify the process to ignore the file when it is run or opened by that process.

Mask

String used to filter the process and file to log or ignore.

Syntax

<process>|<filter>

Example of features used to log

"skype.exe|*.*"

"word.exe|*John*.doc"

Example of features used to ignore

"skype.exe|*.dat"

Log path and access mode Records the file path and access type (i.e.: read, write)
Capture file content If enabled, the file is copied and downloaded at the first access.

Min/Max size

Minimum and maximum size admitted for the file to be downloaded.
Newer than Minimum file creation date to be downloaded.