Stealth copy pen drive in the background

It did so happen that few days back that one of my friends came to my house along with a nice video in his pen drive on how magic is done. We watched it together and it was awesome. But after it was over, I wanted to keep a copy of that video so that I could watch it later but he did not let me do so. Now it was really horrible that after watching a 2 hour long video on my computer he did not allow me to keep it. So I thought of doing something so that next time he comes, I could copy everything from his pen drive without giving him a hint of what I am doing.

Note : This process should not be adopted to steal sensitve and/or confidential data without the prior notice of its owner. Read disclaimer before proceeding.

The Plan:

So basically the whole thing should be done with a key stroke or with a combination of few keys and neither anything should be appearing on the screen nor any notification should be displayed. As for the copying part, it could be easily done with a batch file. But the main problem was how to run that file in the background as a process so that nothing comes up on the screen. This was accomplished by using a Visual Basic Script (VBS). However the whole thing could be done by using the vbs file only, but I always like those .bat files .

Procedure:

The whole process can be setup in 3 simple steps.

Step I : Making the batch file

The batch file simply copies the entire contents of a drive to a pre defined location on the hard disk. As in the case of my computer, the drive letters on my system end with G: (DVD drive). So when a removable media (like a pen drive) is inserted it will be assigned the letter H. And if more usb sticks are plugged, the they will be assigned I:, J: and so on. So you should create different batch files for different drive letters that may show up.

@ECHO OFF
XCOPY H: D:\Copy_of_I /E /H /I /Q /Y
ATTRIB +H D:\Copy_of_I
EXIT

Here the dos command XCOPY has been used instead of simple COPY because the latter does not give much option while copying. The parameters passed along with XCOPY are described below.

/E Copies directories and subdirectories, including empty ones. Otherwise only the files in the root of pen drive will be copied leaving the files inside folders.

/H Copies hidden and system files also (incase any of the files in the pen drive are hidden)

/I If destination does not exist and copying more than one file, assumes that destination must be a directory.

/Q Does not display file names while copying.

/Y Suppresses prompting to confirm you want to overwrite an existing destination file. Be careful while using this switch because it will overwrite any files the destination directory if it has same name with any of the files in the pen drive without any warning. This has been provided so that the copying process does not get halted in the background if such a situation arises.

In the next statement the attribute of the destination folder (where are the contents are copied) is set to hidden so that the fellow cannot figure out that the contents of his drive had been copied while browsing in explorer.

Step II : Running the batch file stealthily in the background

For this purpose the batch file is executed through a VB script

Set WshShell=WScript.CreateObject("WScript.Shell")
obj=WshShell.Run("hdrive.bat",0)
Set WshShell=Nothing

If invisible.vbs and hdrive.bat are not in the same directory then you need to specify the entire path of hdrive.bat.

This VB Script runs the batch file in the background and the process can only be stooped from the task manager. Instead of hdirve.bat any other program can be also be run and then it won’t be listed under the Applications tab of Task Manager. Instead it needs to be stopped from the Processes tab.

Step III : Assigning key combination for running the program

Create a shortcut of invisible.vbs on the desktop and change its properties as under.

So whenever you are on the desktop and press the shortcut key combination, invisible.vbs gets executed which in turn invokes hdrive.bat and the entire copying process takes place in the background, without the notice of the person sitting on the system.

Advertisement