How To Track The File Change

The EaseFilter File Monitor Filter Driver SDK provides you a simple way to develop the Windows application, to track the file change events easily. The file change events include the new file being created, the file being modified or written, file being renamed or moved, file being deleted, file information being changed, file security being changed.

EaseFilter File Monitor Filter Driver, is a kernel-mode component that runs as part of the Windows executive above the file system. The EaseFilter file system filter driver can intercept requests targeted at a file system or another file system filter driver. By intercepting the request before it reaches its intended target, the EaseFilter file system filter driver can log, observe the I/O operations for one or more file systems or file system volumes.

To track the file change events, you need to create a file monitor filter rule to watch the folder which you want to manage. Then you need to register the file change events which you are interested in it, and register the file change notification handler.  For example, if you want to track the file was written, then you need to register the event “NotifyFileWasWritten" in "FileChangeEventFilter".

//create a file monitor filter rule, every filter rule must have the unique watch path. 
FileFilter fileMonitorFilter = new FileFilter("c:\\watchFolder\\*");

//Filter the file change event to monitor all file change events.
fileMonitorFilter.FileChangeEventFilter = (FilterAPI.FileChangedEvents)FilterAPI.NotifyAllFileEvents;

//register the file change callback events.
fileMonitorFilter.NotifyFileWasChanged += NotifyFileChanged;

/// <summary>
/// Fires this event when the file was changed.
/// </summary>
static void NotifyFileChanged(object sender, FileChangedEventArgs e)
{
   Console.WriteLine("NotifyFileChanged:" + e.FileName + ",eventType:" + e.eventType.ToString() + ",userName:" + e.UserName + ",processName:" + e.ProcessName);
}   

Here is the enumeration of the events you can register

/// <summary>
/// The file changed events for monitor filter, it will be fired after the file handle was closed.
/// </summary>
public enum FileChangedEvents:uint
{
/// <summary>
/// Fires this event when the new file was created after the file handle closed
/// </summary>
NotifyFileWasCreated = 0x00000020,
/// <summary>
/// Fires this event when the file was written after the file handle closed
/// </summary>
NotifyFileWasWritten = 0x00000040,
/// <summary>
/// Fires this event when the file was moved or renamed after the file handle closed
/// </summary>
NotifyFileWasRenamed = 0x00000080,
/// <summary>
/// Fires this event when the file was deleted after the file handle closed
/// </summary>
NotifyFileWasDeleted = 0x00000100,
/// <summary>
/// Fires this event when the file's security was changed after the file handle closed
/// </summary>
NotifyFileSecurityWasChanged = 0x00000200,
/// <summary>
/// Fires this event when the file's information was changed after the file handle closed
/// </summary>
NotifyFileInfoWasChanged = 0x00000400,
/// <summary>
/// Fires this event when the file's data was read after the file handle closed
/// </summary>
NotifyFileWasRead = 0x00000800,
}

Here is the File Monitor example for the File Change Events selection.

file change events

In the NotifyFileChanged event, you can get the file changed information as below:

  1. The user name who made the file changed.
  2. The process name who made the file changed.
  3. The file changed types: the file was created, written, renamed, deleted, file information was changed or the file was read.
  4. The new file name if the was renamed.

Here is the FileMonitor demo output console for the File Change Events:

file changed events output