i need if users write a file of drive c or d , evidence file
can you narrow the scope a bit? The OS is constantly writing files to the drive. I assume you need to exclude all the system level activity?
ok. i need evidence when users write anya file of drive c or d or e ...
Why? What's the business need?