File Monitoring (Read,Write etc...) monitoring system.

[Madhan_Saran]

I need to develop a system to monitor operations performed on files/folders.
Such as
1. open,
2. read,
3. write,
4. close,
5. copy,
6 rename,and
7. move


I have stumbled upon one solution.

Having a "File System Filter Driver" which monitors every atomic operation performed on the file system. But the information available out of the driver is too huge to classify into a single user operation.

For example
(*) IRP_MJ_WRITE is the Major function getting initiated when a user tries to write a file.
(*) However more than one IRP_MJ_WRITE happens for a single write.
(*) when user saves the document twice,it is difficult for me to group the IRP_MJ_WRITE's into TWO user writes.


Someone help me on how to proceed on this, or may be any other solution to this problem.

[matze42]

Hi,

if you can use Win-API, take a look at "ReadDirectoryChangesW" in the MSDN.
This works fine and uncomplicated.

Hope this helps,
Matze

[gstercken]

I need to develop a system to monitor operations performed on files/folders.

You might also take a look at FindFirstChangeNotification() / FindNextChangeNotification().

[PadexArt]

Hi,

if you can use Win-API, take a look at "ReadDirectoryChangesW" in the MSDN.
This works fine and uncomplicated.

Hope this helps,
Matze

The only drawback of the function is that it is not available for Win 9x systems. Also, the drive being monitored must have NTFS file system.

[Andreas Masur]

I need to develop a system to monitor operations performed on files/folders.

Is there any special reason why you need to re-invent the wheel?

• Filemon for Windows

[Markus Splenius]

The only drawback of the function is that it is not available for Win 9x systems. Also, the drive being monitored must have NTFS file system.

Neither of these things are much of a drawback these days!!

Markus