Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Detect file 'COPY' operation in Windows

Say I want to be informed whenever a file copy is launched on my system and get the file name, the destination where it is being copied or moved and the time of copy.

Is this possible? How would you go about it? Should you hook CopyFile API function?

Is there any software that already accomplishes this?

like image 721
Attilah Avatar asked Dec 03 '22 07:12

Attilah


2 Answers

Windows has the concept of I/O filters which allow you to intercept all I/O operations and choose to perform additional actions as a result. They are primarily used for A/V type scenarios but can be programmed for a wide variety of tasks. The SysInternals Process Monitor for example uses a I/O filter to see the file level access.

You can view your current filters using MS Filter Manager, (fltmc.exe from a command prompt)

There is a kit to help you write filters, you can get the drivers and develop your own.

http://www.microsoft.com/whdc/driver/filterdrv/default.mspx is a starting place to get in depth info

like image 200
Andrew Avatar answered Dec 21 '22 17:12

Andrew


As there is a .NET tag on this question, I would simply use System.IO.FileSystemWatcher that's in the .NET Framework. I'm guessing it is implemented using the I/O Filters that Andrew mentions in his answer, but I really do not know (nor care, exactly). Would that fit your needs?

like image 22
peSHIr Avatar answered Dec 21 '22 17:12

peSHIr