2

I want to build an app that needs to monitor the opening of the files but I don't find any way to can do it.

With FileSystemWatcher there is no option to can monitor the opening of the files. Just the created, removed and modified ones.

So I wonder if there is any functionality implemented in the advanced searches that could give me the infomration of the files opened after a concrete date. (At least in Mac it's possible but I am not sure if Windows has implemented this)

Other solution would be to develop a File System Filter Driver, but I find this way too hard

user3009804
  • 329
  • 6
  • 19
  • 1
    Related: http://stackoverflow.com/questions/14779616/filesystemwatcher-used-to-watch-for-folder-file-open – jmsb Jul 14 '14 at 15:22
  • How about enabling NTFS last access time and regularly (for example all 5s) checking for changes. Although that does seem like an ugly hack solution the performance impact should me minimal unless you have tons of files. – ASA Jul 14 '14 at 15:25
  • 1
    "Monitor file open" and "files opened after a concrete date" are not really related, so you may be asking about something you don't need. It may happen that all you need is [File.GetLastAccess](http://msdn.microsoft.com/en-us/library/system.io.file.getlastaccesstime%28v=vs.110%29.aspx). – Alexei Levenkov Jul 14 '14 at 15:27
  • 1
    Also related: http://stackoverflow.com/questions/3621661/detect-file-read-in-c-sharp – Sean Airey Jul 14 '14 at 15:28
  • 1
    @Alexei That parameter is deactivated by default on W7 though. – ASA Jul 14 '14 at 15:28
  • 1
    Windows doesn't have any facility to spy on other processes opening files. You can enable auditing, that's as far as it can go. Anti-malware uses viral techniques. – Hans Passant Jul 14 '14 at 15:37

1 Answers1

1

I cant give you a direct answer (because I dont know) but since Microsoft publish the FileMon tool which does exactly what you are after, it seems that Windows does have a way of notifying file open, close and access. This is discussed here Getting a notification when a local file is accessed in windows but this only covers the change of files, not opening and closing. There is a way of getting all the files opened by a process discussed here Delphi - get what files are opened by an application which is possibly what FileMon is using, but there are caveats (i.e. its an internal OS API).

Hope this helps, sorry cannot give a direct answer.

Community
  • 1
  • 1
PhillipH
  • 6,182
  • 1
  • 15
  • 25