Document Tracking Settings

Spector Pro can record various types of document activity that occurs on your local and network drives, as well as on drives that have been mapped to different file devices (for example CD ROM, USB storage devices, floppy drives, zip drives).

This may reveal anything from the name of a new file that you can't remember, to evidence that a private family file has been copied, to confirmation that someone at the office has been stealing confidential files. See Viewing Document Tracking.  

Use these settings to:

Turn document tracking on and off.

Configure what kinds of document activity you want to track on each drive (creating a file, opening to write, deleting, and renaming).

Limit tracking by defining specific filters. These filters can include or exclude documents based on their location in your computer (for example the drive or directory), the type of document (for example Word, Excel, PowerPoint), or the file name.

Find out which documents were printed or burned to a CD or DVD.

What Kind of Document Activity Can I Track?

The following activities are tracked, by default, for Removable and CD / DVD devices only.

• Creating New Files - Information is captured every time a new file is created on that drive.

• Opening to Write to Existing Files - Information is captured every time an existing file is opened for writing on that drive. Just because you open a file does not mean you actually write to it. You may open a file and read it; you may copy or delete a portion of it, or you may save it to a new location with a new name.

• Deleting Files - Information is captured every time an existing file is deleted from the drive. This is useful if files are missing and you want to know who deleted them and when.

• Renaming Files - Information is captured every time an existing file is renamed. This can be helpful if you are trying to track a file through the system. Many applications create temporary files while you are editing an original. When you are done editing, the original file is deleted and the temporary file is saved.

The following activities are tracked, by default, for all active drives.

• Printing Files - Information is captured each time a file is printed.

What Kind of Drives and File Devices Can I Track?

You can track document activity on any drive associated with the drive letters A: through Z: on your computer, and any file device mapped or directly accessed using a Universal Naming Convention (UNC) specification. But by default, tracking is applied to a drive type, rather than to a particular drive; specifically tracking is applied to Removable and CDs / DVDs.

Different file devices, when mapped to a drive, create different drive types. Spector Pro recognizes four of them:

• Local - Your local hard drive. Be very careful when configuring the tracking of local hard drives as Windows generates a large number of file operations on local hard drives.

• Network - Not attached to your machine, and includes any file device using a UNC specification.

• Removable - You can remove the drive media. This includes file devices such as floppy drives, zip drives, USB storage devices, and memory sticks.

• CD ROM - Includes CDs and DVDs. The application performing the activity must use the Windows IMAP interface (Image Mastering Applications Programming Interface). If you are using Window’s Explorer, logoff and then log back on for the setting to take effect.

For a full explanation of Default Tracking, how it works with different drives, and why it makes Spector Pro's document tracking flexible and efficient, click here.

Accessing Document Tracking

To access the Document Tracking pane:

1. Open the Settings window.

2. Locate Document Tracking under Recording in the Navigate pane at left.

3. Click to open the Document Tracking pane. This pane contains:

• Options: select the recording option.

• Drives and Tracking: configure activity on each drive.

• File Name Filter: add or delete filters.

• Other: control printing activity and WinXP CD / DVD burning.

Customizing Document Settings

Close all applications that are running and log off all users to ensure that new settings affect these applications and users.

To select recording options:

1. Enable Document Tracking - By default, this box is checked to enable document tracking.

2. Click OK to save the changes you have made, or Cancel to remove them. The Settings window closes.

Tracking Configurations

If you click on the dropdown list next to Drive, each drive A through Z and UNC is displayed. The list automatically indicates which drives are currently active on the monitored PC and how they are mapped: Local, Network, Removable or CD ROM. (If a drive is mapped to a device using the IMAP interface, it does not appear as mapped to a drive on this list).

If a new drive becomes active, it automatically appears on the list with its mapping.

Spector Pro allows you to adjust document tracking by changing the tracking for a specific drive, or by changing the Default Tracking settings that affect all drives. Tracking options include:

• Do Not Track - Select this if a particular drive is ordinarily tracked, but you do not want to track it.  

• Use Default Tracking - Select this if you want to apply Default Tracking settings to a particular drive that ordinarily does not have it.

• Use Custom Tracking - Select this if you want to alter which activities to include in the tracking for a particular drive. You can eliminate an activity that would normally be tracked, OR you can add an activity that would not normally be tracked.

• Default Tracking Button - Select this if you want to alter the Default Tracking settings for all drives. You can change to which drive types default tracking applies, OR you can eliminate one or more items from the list of activities included in Default Tracking.

For examples of how to use these settings to change tracking configurations, click here.

To filter document tracking:

Spector Pro allows you to filter document tracking so that you record only file activity that you are interested in. You can configure the system to include or exclude specific files types (by indicating an extension), specific file or directory names (by indicating a word or words), files in a particular location (by indicating a path or drive), or any combination of these.   

The filter allows the * and ? wildcards (as in DOS), and you can specify wildcard paths and drives.

* = a match with zero or more characters

? = a match with zero or one character

1. Include or Exclude - Click the appropriate button, depending on what you want to do. The default is Exclude.

2. Add - Click this button to add a filter. The File Filter window opens.

3. Type in the filter.

4. Click OK to accept the filter, or Cancel to reject it. The File Filter window closes. If the filter was accepted, it now appears in the File Name Filter list.

To delete a filter in the File Name list, click to select it and then click Delete. The entry is removed from the list.  

5. Click OK to save the changes you have made, or Cancel to discard them. The Settings window closes.

To track printing and burning:

1. Track Printed Documents - By default, this box is checked to track printed documents. Click to disable the tracking of printed documents, and the checkmark is removed.

2. Track WinXp CD / DVD  Burning (IMAPI) - By default, this box is checked to track IMAPI documents written to CD / DVD devices. Click to disable this tracking, and the checkmark is removed.

3. Click OK to save the changes you have made, or click Cancel to discard them. The Settings window closes.

Next you will review Configuring Document Tracking.