Where File Uploads Actually Show Up in Windows and Network Logs
When someone asks "did data leave this PC", the answer is not in one log — it is spread across five of them, and each one proves a different thing. This page ranks the surfaces by what they can honestly tell you, so you stop asking a firewall log a question only an endpoint can answer.
✍️ Technical Anshu🪟 Windows 10 / 11⏱️ Reference guide
🎥 Watch the complete method in the video — the exact on-screen steps, start to finish
Every upload crosses several systems on its way out, and each system keeps a different kind of note. The endpoint knows the file. The firewall knows the connection. DNS knows the name that was looked up. The proxy or router knows the volume. Read together, they reconstruct an upload almost completely. Read alone, each one misleads in its own way. Here is the honest ranking, from strongest evidence to weakest.
The Five Surfaces, Ranked by What They Prove
1. Endpoint file tracingFile name, user, time, destination — strongest
2. Proxy logHost name, bytes up and down per session
3. DNS query logWhich service names the PC resolved
4. Windows Firewall logDestination IP and port, allowed or dropped
5. Router traffic totalsVolume per device — no destinations at all
Ranking panel. Lower surfaces still matter — they confirm or contradict the layers above them.
1
Surface 1 — Endpoint File Tracing Sees the File
An endpoint agent with file activity auditing is the only surface that records the event the way a human describes it: this file, this user, this time, sent there. DLP-class endpoint platforms keep exactly this record for uploads, cloud sync and removable media.
This is the surface to check first when a specific file matters
It is also the easiest surface to lose — if the agent is stopped, removed or never installed, this layer is simply absent, and the absence itself should be an alert
Keep these records centrally. A file log that only exists on the PC it describes is evidence stored inside the crime scene
2
Surface 2 — The Proxy Log Counts the Bytes
If office traffic passes through a web proxy, the proxy sees every session's host name and how many bytes went each way. It cannot see inside HTTPS, but volume by destination is a powerful pattern: normal browsing downloads far more than it uploads, so a session that uploads heavily stands out on its own.
Sort proxy records by bytes sent, per user or per PC — the upload-heavy sessions rise to the top immediately
A proxy only sees what is sent through it. Software that ignores the system proxy settings bypasses this surface entirely — another reason the endpoint layer ranks first
3
Surface 3 — DNS Logs Name the Service
Before any upload, the PC asks DNS to resolve the service's name. A DNS query log therefore reads like a diary of intentions: lookups for file-sharing and personal cloud domains from a PC that has no business using them are worth a calm question.
Windows DNS Server can log queries; many routers and firewalls log them per device as well
Diagnose live with nslookup if you need to confirm what a name resolves to, but remember the log, not the lookup, is the evidence
DNS shows a lookup happened — not that a file moved. Treat it as a pointer, not a proof
4
Surface 4 — The Firewall Log Proves the Connection
The Windows Firewall log at %systemroot%\system32\LogFiles\Firewall\pfirewall.log records allowed and dropped connections with destination IP, port and time. It answers one question precisely: did this PC open a connection to that address?
Enable it per profile with netsh advfirewall set allprofiles logging logallowedconnections enable and raise the file size so history survives
IPs are weaker than names — one cloud service answers from hundreds of addresses — so pair firewall records with the DNS log from the same minutes
5
Surface 5 — Router Totals Show Volume Only
The humblest surface still earns its place. Per-device traffic statistics on the router say which machine pushed unusual data out of the building and when — nothing about where it went, but enough to know which PC's other logs to read first.
Check totals during an incident before deep-diving anywhere else — they tell you where to look
On a live PC, the same question is answered by Resource Monitor's Network tab or a quick netstat -ano matched against Task Manager's process list
🔴 The rule of the five surfaces: never build a conclusion on the weakest surface that could support it. Router totals justify a look. DNS justifies a question. Only the endpoint record justifies naming a file — and even then, corroborate it with a second layer before you act.
🎥 Watch the Complete Method in the Video
Watch the video for the full tracking walkthrough, then use this ranking to decide which logs your own office should switch on first.
Which single log should I check first after a suspected upload?
The endpoint file tracing record, if you have it — it is the only one that names the file. If you do not, start with router or proxy upload totals to find which PC and what time window, then read that PC's firewall and DNS logs for the same minutes.
Can a firewall log show me the name of an uploaded file?
No. Firewall logs record connections — addresses, ports, times and whether they were allowed. File names exist only where the file itself was handled: on the endpoint, or inside a service's own audit log such as a company cloud tenant's activity record.
Why keep logs that cannot prove anything on their own?
Because corroboration is what makes evidence strong. An endpoint record that matches the DNS lookup, the firewall connection and the proxy byte count at the same minute is very hard to argue with — and each layer covers the others' blind spots.
This guide accompanies the file upload tracking video by Technical Anshu • Monitor only machines you administer, under a written policy • Stuck on a step? Ask in the video comments.