How do I track file copying?
There's no such filesystem operation as file copying. The copy operation involves file_open_for_reading, file_open_for_writing, read, write and two file_close operations. You can track each operation separately and try to detect their combination. But remember that copying of data can be also done by compressing or encrypting the data in memory and writing the compressed or encrypted data to the destination.