who initiated file operations on drive in c#

Question

0.00/5 (No votes)

See more:

Hi,

I am trying to track all computer drives for user activities on computer drive by using FileSystemWatcher class but now my problem is that any file operation due to any reason means by any software or any system update is also traced by this class but i want to track only activity where user comes in picture.

Posted 17-Dec-14 17:53pm

sachinskb

Updated 17-Dec-14 18:08pm

George Jonsson

v2

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Manfred Rudolf Bihy · Answer 1 · 2014-12-17T20:38:00

I hope you are aware that all human interaction with a computer always boils down to being a piece of software telling your binary friend what to do. The software may run under different accounts, but once a user logs on all his actions are carried out under the authorization of the account he logged on with, disregarding impersonization here for the sake of simplicity.
Everything he does to a file through the explorer or an editor or any software started under his account will be undistinguishable from one another in regard to the originator of said action.
One could imagine writing an explorer extension that would take note of a users action in the explorer, but that could be faked by a program that would remote control the explorer, be it by manipulating the windows message queue or by simulating mouse clicks and key strokes via api calls. This would add a special twist as that program could run under a different account, but it would seem to the system as if the user had initiated these actions.

Regards,
Manfred