Click here to Skip to main content
11,712,792 members (87,895 online)
Click here to Skip to main content

Spying a file system

, 22 Sep 2003 CPOL 301.2K 5.5K 118
Rate this:
Please Sign up or sign in to vote.
Article describes how to create a file system spy application

Introduction

Windows applications can do dynamic monitoring of any specified directory. Once changes have occurred and are detected, the spy application can run various tasks ( run antivirus, log activity, determine more information about changes, call other tasks etc).

Win 32 API provides three functions that are based on the events:

  • FindFirstChangeNotification
  • FindNextChangeNotification
  • FindCloseChangeNotification
  • ReadDirectoryChangesW

These allow creating watchdog or spying applications.

How to create

First of all spy application should call FindFirstChangeNotification to create event handler to monitor changes specified as the functions parameters.

HANDLE h = FindFirtsChangeNotification("C:\\Program Files”, TRUE, mask); 

This function allows to handle following types of notifications:

  • FILE_NOTIFY_CHANGE_FILE_NAME – File creating, deleting and file name changing

  • FILE_NOTIFY_CHANGE_DIR_NAME – Directories creating, deleting and file name changing

  • FILE_NOTIFY_CHANGE_ATTRIBUTES – File or Directory attributes changing

  • FILE_NOTIFY_CHANGE_SIZE – File size changing

  • FILE_NOTIFY_CHANGE_LAST_WRITE – Changing time of write of the files

  • FILE_NOTIFY_CHANGE_SECURITY – Changing in security descriptors

The result of FindFirstChangeNotification can be passed as parameter in to WaitForSingleObject and when specified event has occurred, application can do various actions such as: antivirus starting, adding record to the log file, and so on. Note that this function does not detect changes, it only creates synchronization event and marks it if changes are made. After our spy application handles changes, it should call FindNextChangeNotification to continue monitoring or FindCloseChangeNotification to finish it.

Win32 API provides also ReadDirectoryChangesW that can operate with following filters (MSDN) :

FILE_NOTIFY_CHANGE_FILE_NAME

Any file name change in the watched directory or subtree causes a change notification wait operation to return. Changes include renaming, creating, or deleting a file.

FILE_NOTIFY_CHANGE_DIR_NAME

Any directory-name change in the watched directory or subtree causes a change notification wait operation to return. Changes include creating or deleting a directory.

FILE_NOTIFY_CHANGE_ATTRIBUTES

Any attribute change in the watched directory or subtree causes a change notification wait operation to return.

FILE_NOTIFY_CHANGE_SIZE

Any file-size change in the watched directory or subtree causes a change notification wait operation to return. The operating system detects a change in file size only when the file is written to the disk. For operating systems that use extensive caching, detection occurs only when the cache is sufficiently flushed.

FILE_NOTIFY_CHANGE_LAST_WRITE

Any change to the last write-time of files in the watched directory or subtree causes a change notification wait operation to return. The operating system detects a change to the last write-time only when the file is written to the disk. For operating systems that use extensive caching, detection occurs only when the cache is sufficiently flushed.

FILE_NOTIFY_CHANGE_LAST_ACCESS

Any change to the last access time of files in the watched directory or subtree causes a change notification wait operation to return.

FILE_NOTIFY_CHANGE_CREATION

Any change to the creation time of files in the watched directory or subtree causes a change notification wait operation to return.

FILE_NOTIFY_CHANGE_SECURITY

Any security-descriptor change in the watched directory or subtree causes a change notification wait operation to return.

Sample

Give your attention to the following code in the demo project:

void ThreadRoute( void* arg )
{
 HANDLE file = FindFirstChangeNotification("c:\\Program Files", 
     FALSE, (DWORD)((Param*)arg)->parameter);
 WaitForSingleObject(file, INFINITE);
 CTime tm = CTime::GetCurrentTime();
 m_Sec.Lock(); // Enter to Critical section for display notification
 int item = pList->InsertItem(pList->GetItemCount(), ((Param*)arg)->message);
 pList->SetItemText(item, 1, tm.Format("%Y/%m/%d - %H:%M:%S"));
 m_Sec.Unlock();

 while (true)
 {
   FindNextChangeNotification(file);
   WaitForSingleObject(file, INFINITE);
   tm = CTime::GetCurrentTime();
   m_Sec.Lock(); // Enter to Critical section for display notification
   item = pList->InsertItem(pList->GetItemCount(), ((Param*)arg)->message);
   pList->SetItemText(item, 1, tm.Format("%Y/%m/%d/ - %H:%M:%S"));
   m_Sec.Unlock();
  }
}

and here is the fragment using ReadDirectoryChangesW

void ThreadRoute1( void* arg ) 
 {
  USES_CONVERSION;
  HANDLE hDir = CreateFile( 
    CString("c:\\Program Files"), /* pointer to the file name */
    FILE_LIST_DIRECTORY,                /* access (read-write) mode */
    FILE_SHARE_READ|FILE_SHARE_DELETE,  /* share mode */
    NULL, /* security descriptor */
    OPEN_EXISTING, /* how to create */
    FILE_FLAG_BACKUP_SEMANTICS, /* file attributes */
    NULL /* file with attributes to copy */
  );

  FILE_NOTIFY_INFORMATION Buffer[1024];
  DWORD BytesReturned;
  while( ReadDirectoryChangesW(
     hDir, /* handle to directory */
     &Buffer, /* read results buffer */
     sizeof(Buffer), /* length of buffer */
     TRUE, /* monitoring option */
     FILE_NOTIFY_CHANGE_SECURITY|
     FILE_NOTIFY_CHANGE_CREATION|
     FILE_NOTIFY_CHANGE_LAST_ACCESS|
     FILE_NOTIFY_CHANGE_LAST_WRITE|
     FILE_NOTIFY_CHANGE_SIZE|
     FILE_NOTIFY_CHANGE_ATTRIBUTES|
     FILE_NOTIFY_CHANGE_DIR_NAME|
     FILE_NOTIFY_CHANGE_FILE_NAME, /* filter conditions */
     &BytesReturned, /* bytes returned */
     NULL, /* overlapped buffer */
     NULL))... /* completion routine */

These are thread functions that do the described spying actions.

Conclusion

The attached Demo application starts separate threads to monitor all possible changes in the "c:\\Program Files" directory and shows occurred notifications and its date/time in the List control. Demo application shows also how to use ReadDirectoryChangesW and compare both methods visually.

Functionality of the Demo application can be extended to determine concrete changes, to log changes in to file, run external applications or tasks on the specified event, use described methods as system service and so on. Readers have full freedom to modify and use the demo project.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author

Vitali Halershtein
Software Developer (Senior)
Belarus Belarus
I am a professional Software Developer with more than 10 years' experience.
Certifications: MCSD, MCP, Brainbench, Masters Degree in Computer Science.

I am open for contacts and interesting ideas.
You can write me at:
vitali_eh@yahoo.com

You may also be interested in...

Comments and Discussions

 
GeneralThank you Pin
khejing 111687573-Nov-14 15:58
memberkhejing 111687573-Nov-14 15:58 
GeneralMy vote of 5 Pin
XinDavid13-Jun-12 20:54
memberXinDavid13-Jun-12 20:54 
GeneralThanks Pin
peterpc070116-Mar-12 15:46
memberpeterpc070116-Mar-12 15:46 
GeneralMy vote of 5 Pin
Member 80364465-Nov-11 5:59
memberMember 80364465-Nov-11 5:59 
GeneralMy vote of 4 Pin
sahar792516-Jan-11 4:38
membersahar792516-Jan-11 4:38 
GeneralMy vote of 5 Pin
Option Greek22-Sep-10 3:26
memberOption Greek22-Sep-10 3:26 
GeneralIt is a good example for ReadDirectoryChangesW Pin
zz96227-Oct-09 23:14
memberzz96227-Oct-09 23:14 
GeneralRe: It is a good example for ReadDirectoryChangesW Pin
conrad Braam2-Sep-10 4:10
memberconrad Braam2-Sep-10 4:10 
QuestionGet new path Pin
fer_cyberlinklabs3-Mar-09 14:55
memberfer_cyberlinklabs3-Mar-09 14:55 
AnswerRe: Get new path Pin
Kdiggins14-Mar-09 7:21
memberKdiggins14-Mar-09 7:21 
GeneralReadDirectoryChangesW Problem~~ Pin
york52812-Jun-08 8:09
memberyork52812-Jun-08 8:09 
GeneralRe: ReadDirectoryChangesW Problem~~ Pin
conrad Braam2-Sep-10 4:12
memberconrad Braam2-Sep-10 4:12 
GeneralFILE_ACTION_RENAMED_NEW ASSERT FAILURE Pin
phoenix_fei_fei18-Nov-07 13:40
memberphoenix_fei_fei18-Nov-07 13:40 
GeneralDo not detect all the changed files Pin
GameProfessor10-May-07 16:55
memberGameProfessor10-May-07 16:55 
GeneralRe: Do not detect all the changed files Pin
DavidCrow4-Oct-07 7:43
mvpDavidCrow4-Oct-07 7:43 
GeneralRe: Do not detect all the changed files Pin
Arsene Shahin2-Jun-08 23:51
memberArsene Shahin2-Jun-08 23:51 
QuestionRe: Do not detect all the changed files Pin
DavidCrow3-Jun-08 4:20
mvpDavidCrow3-Jun-08 4:20 
GeneralRe: Do not detect all the changed files Pin
Vitali Halershtein3-Jun-08 4:14
memberVitali Halershtein3-Jun-08 4:14 
GeneralRe: Do not detect all the changed files Pin
DavidCrow3-Jun-08 4:22
mvpDavidCrow3-Jun-08 4:22 
GeneralRe: Do not detect all the changed files Pin
Vitali Halershtein3-Jun-08 4:39
memberVitali Halershtein3-Jun-08 4:39 
QuestionHow to terminate the thread? Pin
Guna Velu1-May-07 23:23
memberGuna Velu1-May-07 23:23 
AnswerRe: How to terminate the thread? Pin
DavidCrow4-Oct-07 7:45
mvpDavidCrow4-Oct-07 7:45 
AnswerRe: How to terminate the thread? Pin
Vitali Halershtein20-Dec-07 0:24
memberVitali Halershtein20-Dec-07 0:24 
Questionlocking a folder and particular drive Pin
amitkumart13-Apr-07 20:31
memberamitkumart13-Apr-07 20:31 
GeneralRe: locking a folder and particular drive Pin
Vitali Halershtein20-Dec-07 0:20
memberVitali Halershtein20-Dec-07 0:20 
GeneralCorrect Buffer handling Pin
64errors10-Aug-06 21:35
member64errors10-Aug-06 21:35 
Generalcheck Fwatch in MSDN Pin
rudo3221-Jun-06 23:09
memberrudo3221-Jun-06 23:09 
QuestionCan I get some message when some file is copyed? Pin
tanshy16-May-06 9:26
membertanshy16-May-06 9:26 
Questionhow to detemine if file alreay open Pin
Balkrishna Talele11-Jan-06 23:14
memberBalkrishna Talele11-Jan-06 23:14 
AnswerRe: how to detemine if file alreay open Pin
Vitali Halershtein11-Jan-06 23:44
memberVitali Halershtein11-Jan-06 23:44 
GeneralRe: how to detemine if file alreay open Pin
Balkrishna Talele11-Jan-06 23:50
memberBalkrishna Talele11-Jan-06 23:50 
GeneralNotification when a folder is shared/unshared Pin
TBan29-Sep-05 23:18
memberTBan29-Sep-05 23:18 
GeneralRe: Notification when a folder is shared/unshared Pin
Vitali Halershtein11-Jan-06 23:51
memberVitali Halershtein11-Jan-06 23:51 
GeneralCannot get file name changed in Win9x Pin
Yulaw18-Sep-05 18:33
memberYulaw18-Sep-05 18:33 
GeneralRe: Cannot get file name changed in Win9x [modified] Pin
Vitali Halershtein19-Sep-05 4:29
memberVitali Halershtein19-Sep-05 4:29 
QuestionPotential problem Pin
Carlton Craighead28-Aug-05 6:37
sussCarlton Craighead28-Aug-05 6:37 
QuestionIs there any other way? Pin
dariushthegreat24-Aug-05 4:14
memberdariushthegreat24-Aug-05 4:14 
AnswerRe: Is there any other way? [modified] Pin
Vitali Halershtein24-Aug-05 21:59
memberVitali Halershtein24-Aug-05 21:59 
QuestionHow can I get IP address? Pin
Mr. Wall19-May-05 23:44
sussMr. Wall19-May-05 23:44 
GeneralWhy can't I rename folders Pin
funxav5-May-05 11:28
memberfunxav5-May-05 11:28 
GeneralRe: Why can't I rename folders Pin
funxav5-May-05 11:41
memberfunxav5-May-05 11:41 
GeneralRe: Why can't I rename folders Pin
mousse_225-Jul-05 21:49
membermousse_225-Jul-05 21:49 
GeneralJava Integration Pin
tpliakas24-Mar-05 5:35
membertpliakas24-Mar-05 5:35 
GeneralRe: Java Integration [modified] Pin
Vitali Halershtein24-Aug-05 22:12
memberVitali Halershtein24-Aug-05 22:12 
GeneralI'm trying to write some code on my own Pin
lms0073-Mar-05 0:50
memberlms0073-Mar-05 0:50 
GeneralRe: I'm trying to write some code on my own [modified] Pin
Vitali Halershtein24-Aug-05 22:21
memberVitali Halershtein24-Aug-05 22:21 
AnswerRe: I'm trying to write some code on my own Pin
akemper11-Sep-06 1:18
memberakemper11-Sep-06 1:18 
Questioncan you tell who created/deleted the file(s)? Pin
korsuas29-Jan-05 7:08
memberkorsuas29-Jan-05 7:08 
AnswerRe: can you tell who created/deleted the file(s)? Pin
Anonymous10-Feb-05 11:58
sussAnonymous10-Feb-05 11:58 
GeneralRe: can you tell who created/deleted the file(s)? Pin
korsuas11-Feb-05 0:34
memberkorsuas11-Feb-05 0:34 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web04 | 2.8.150819.1 | Last Updated 23 Sep 2003
Article Copyright 2003 by Vitali Halershtein
Everything else Copyright © CodeProject, 1999-2015
Layout: fixed | fluid