Detect file 'COPY' operation in Windows

Question

Say I want to be informed whenever a file copy is launched on my system and get the file name, the destination where it is being copied or moved and the time of copy.

Is this possible? How would you go about it? Should you hook CopyFile API function?

Is there any software that already accomplishes this?

Answer 1

Windows has the concept of I/O filters which allow you to intercept all I/O operations and choose to perform additional actions as a result. They are primarily used for A/V type scenarios but can be programmed for a wide variety of tasks. The SysInternals Process Monitor for example uses a I/O filter to see the file level access.

You can view your current filters using MS Filter Manager, (fltmc.exe from a command prompt)

There is a kit to help you write filters, you can get the drivers and develop your own.

http://www.microsoft.com/whdc/driver/filterdrv/default.mspx is a starting place to get in depth info

Answer 2

As there is a .NET tag on this question, I would simply use System.IO.FileSystemWatcher that's in the .NET Framework. I'm guessing it is implemented using the I/O Filters that Andrew mentions in his answer, but I really do not know (nor care, exactly). Would that fit your needs?