2

I am trying to determine if a volume name was changed using WqlEventQuery.

So far I was able to produce a query that detects changes in volumes (this answer in another question was a big help).

SELECT * FROM __InstanceOperationEvent WITHIN 2 WHERE TargetInstance ISA 'Win32_Volume'

The problem with this query is that it detects all changes to the volume (free space change, open the volume, writing files to the volume, etc.) creating too many events and thus defeating the purpose of using the WqlEventQuery.

I saw a related question (Is There any API in windows to detect whether the disk situation is changed?), but none of the answers are helpful and I already added my own response.

Community
  • 1
  • 1
helder.tavares.silva
  • 674
  • 6
  • 13

0 Answers0