How to find out who sent a file to competitors?

Question

Information Security

Hello. The crux of the matter is this. Umtt office, there are 7 people sitting there, all have windows computers and all have access to one common mail. A drawing file was sent to this mail, which then got to competitors. How can you figure out the person who did this? What are the options?
I thought about putting some kind of program for monitoring the screen and recording video from the screens on all computers, and send a drawing of a duck, and see who and what will do according to the records. Let me know if you know such a program. And how do you like this option?
Do you have other options?

Answer 1

The wrong question. We have to ask how to prevent this from happening again.

Answer 2

Putting shadowing you will not solve the current issue.
To decide the current one, you need to know whether all employees opened this file at all. If not all, then you can find out who opened it. Do you know how he got to competitors? Was it mailed? Do you know the approximate time when it was delivered?

Answer 3

You can not install anything, but tell the employees that you have installed a tracking program.

Answer 4

Mail, of course, somewhere on mail.ru? Kroilovo leads to popadalovo... Look at the header of the letter in the sent ones - maybe the IP from which the letter was sent is marked there. Maybe not.
You can use Stakhanovets as an SMP - it’s true that it’s not easy to deploy it (I don’t know how it was in 7.x, in 5.x it was not easy). For a one-time action, you don’t even have to pay - it’s supposed to take a few days for testing.
But the joke is that the Stakhanovite can be liked :D Because he really gives a complete picture of what a person does during the working day :)
Somewhere I read a note that one leader, who beat himself in the chest with the heel of his left hind leg, that he did not need to set up the SMP, when he did set it behind a kapka, was surprised to find out that his subordinates call him "Our Pufistik" (he burred, probably :)) ...

Answer 5

even opening a directory leaves traces, especially opening a file, contact special firms that are investigating if the price of the issue is important and covers the costs of forensic