I want to detect and log to file Explorer operations such as copy/cut/delete/paste.
I have read about FileSystemWatcher, but I also noticed it has some issues since there is no copy/cut events available which can be confusing with whatever I want to do.
The operating system and FileSystemWatcher object interpret a cut-and-paste action or a move action as a rename action for a folder and its contents. If you cut and paste a folder with files into a folder being watched, the FileSystemWatcher object reports only the folder as new, but not its contents because they are essentially only renamed.
FileSystemWatcher is hooking the create file and delete file events to the changed and renamed events which can't really help me to determine if it was made by the user or some another process. Furthermore I cannot be 100% sure what happened to the file whether it was copied or cut etc.
I also need to keep track of the locations "from/to" and the name of file.
Is there some alternative to the FileSystemWatcher that can distinguish between these actions?
I think the FileSystemWatcher would be of use in this scenario. You could use the Changed event, which occurs when a file or directory is changed - like a copy/paste action.
See the MSDN Documentation for this event, and the class itself. Note that there are other events that you can also use for the delete/cut actions.
The events use the FileSystemEventArgs which contains properties for FullPath and Name.
Related
I am using a FileSystemWatcher and i got 2 cases that don't raise events.
lets say i watch on C:/temp,
In case i have already 2 folders with files inside the watched directory, if i cut-paste or move them inside the watched dir to another folder i dont get any event.
Some one know a way i can get events on this files that moved?
Watched directory:
c:/temp
|--test1
| |--test1.txt
|
|--test2
| |--test2.txt
if i move or cut-paste test2 folder into test1 i don't get event on test2.txt.
EDIT: I'm using the code from FileSystemWatcher docs which can find here:
https://learn.microsoft.com/en-us/dotnet/api/system.io.filesystemwatcher?view=net-5.0
hope you can help me, thanks :)
Moving a folder or a file doesn't change it. If you want to track moves, make sure to watch for the Renamed event and set the filters appropriately.
As per the documentation:
COPYING AND MOVING FOLDERS
Event Handler
Events Handled
Performs
OnChanged
Changed, Created, Deleted
Report changes in file attributes, created files, and deleted files
OnRenamed
Renamed
List the old and new paths of renamed files and folders, expanding recursively if needed.
Note that strictly speaking, the file system watcher doesn't watch for changes in content - only the filesystem entries. It's possible to change file contents without changing the filesystem entries, so make sure that it's good enough for your use.
I'm trying to use the FileSystemWatcher to watch a specific subdirectory and log the events to a file. I can ignore the file changes but I can't get around ignoring the changes notified by the folder it is in. So I get stuck in an infinite loop of the folder it's in being changed, logged to the file, the folder is changed, the changed it logged, etc. Is there a way to stop this without completely ignoring the folder the file is in? I can't differentiate between a change made to the folder from a different file or the file used for logging changes. For example, if I have a folder named "Stuff" and the files "log.txt" and "work.txt", if I modify "work.txt" then I will get a notification that "work.txt" changed, and "Stuff" changed, and "log.txt" which will then modify "Stuff" which will be logged etc.
I need to monitor a file for changes and see exactly where it has been modified.
It seems like I can't use FileSystemWatcher as I only get notified that a file has been modified but I can't know exactly what changed, and storing copies of the file to do a diff after the event is raised is not feasible since the file is really big.
I would like to implement something like what SysInternals have on their Process Monitor software, that tells us, for a WriteFile event, the modified part of the file given an offset and length.
I read that there is a Windows API that does this, but I couldn't find anything on how or where to start implementing it on a .net 3.5 application.
From what I have investigated, the .NET platform provides this event for handling file change events. However, this alone will not let you know what part of the file has changed.
You will need to store somewhere a copy of the file that is compared to the file whenever it changes, and then update that copy when the comparison is done. This is a very basic solution and can get really inefficient if the file is too large.
Using the FileSystemWatcher you can subscribe to the changed event ChangedEvent
FileSystemEventArgs contains a property FullPath which can be passed in to FileInfo. This will give you some basic file information, which can be stored to a database for example. You can keep a history of the file changes this way.
If you need to compare the content of the files it is more challenging and the approach will be different depending on file type.
How would you go about detecting, blocking, or just in general referring to the Send File operation you can do to any file/folder on Windows. What exactly is happening when a send file happens and is there any kind of built in programmability in .NET or is it something similar to how doing a move works(It gets deleted first and then created in the new location.)
I just want to know if there is any way to detect when a Send File happens or what windows does with the file/folder when a send file is executed.
If you are speaking of the "Send To" context menu when you right-click on a file/folder, that is the result of a shell extension handler. Pretty sure there's now way to intercept those:
Is there a Click Handler for Shell Extension
MS documentation on registering/creating your own handers is below:
http://msdn.microsoft.com/en-us/library/windows/desktop/cc144067%28v=vs.85%29.aspx
http://msdn.microsoft.com/en-us/library/windows/desktop/cc144110%28v=vs.85%29.aspx
I presume that if you select "Send To" and pick a folder/drive, then it would do a standard move or copy (depending on if it is the same drive or not). As mentioned by Alan, you can use a FileSystemWatcher to try and monitor specific files/directories, but be careful being over broad with what you are watching, because there are limitations on how fast FSW can receive events, meaning if you watch to much you will miss events. Another option if you absolutely must see the file move would be to hook into the Change Journal, but that gets really ugly.
If you want to stop someone from moving or copying a file, you would have to alter its permissions for read and/or modify to exclude the user.
There is a FileSystemWatcher class that may help you detect changes to the file system. Also, the File Class has a static method for Move and other file operations. You may look into the System.IO namespace
When you move a file, it doesn't usually get recreated and deleted (if they are on the same device). Usually its location is just modified. (hence it happens almost instantly even on large files)
i am doing an application that uses file system watcher and the main aim is to monitor files that are being copied , so i looked at the file system watcher method i found 4 events i can sue , they are change , delete , rename and create , i didn't find the copy event , umm and i'd like to watch specific files and when a user tries to copy the files i prevent him from doing so using the file system watcher method , so in file system watcher is there any method for copying files monitoring that i can use ? , sorry my question may look stupid but this is the first time i use file system watcher and i read about it a lot and almost all people agree about the 4 events that can be used in that class .
There is no operation called copying a file.
Rather, copying is a combination of reading one file and writing another one.
You cannot reliably do this.
You cannot do this with FileSystemWatcher
May be monitor Clipboard and if you find list of files, check location of it
I think you can at least have a notification of who copied the file by using WMI notification. Another option is restricting user access to the folders.
Try this link.
http://technet.microsoft.com/en-us/library/ee176985.aspx#EHAA
Why don't you check that the executable is launched from the usb key at the beginning of your software ? this way the user who copied the file won't be able to launch it even if he copied the exe.