Detect if a file was modified, even within the last second, without hashing?

Question

This applies to Mac, but it may also apply to Linux, so I've tagged it as such.

I'm recursing through a directory and getting a tree, with filesystem attributes.

I then recurse again (and again, and again) each time the window comes back into focus. When I read the directory, I'm looking for any files that got modified and need to act on them.

The obvious thing that came to mind was to compare the modification dates of each file, however my unit tests proved that this not reliable since the tests themselves execute in less than a second... the result being that files my tests changed go considered unmodified (as it's only accurate to 1 second).

My fix thus far has been to also compare the file size, but this runs the risk that if the file was changed, and the resulting size is the same, it will also go undetected.

Far from hashing each file, which is just not feasible (too slow when recursing a whole directory tree), is there something else I can use that HFS/HFS+ offers? Like some sort of version number/modification count attached to the file? I'm fearing not, although in reality the edge case of files changing as fast as my unit tests are changing them isn't likely to be an issue in a real use case.

Answer 1

Real time, least load solutions:

• Linux: inotify
• Mac: kqueue

Note that your issue regarding modification time resolution is only specific to HFS+.

The most common cross-platform solution used is File Alteration Monitor.

Additional links:

• detect if something is modified in directory, and if so, backup - otherwise do nothing
• c program for directory monitor
• http://en.wikipedia.org/wiki/Inotify
• http://en.wikipedia.org/wiki/HFS%2B
• http://en.wikipedia.org/wiki/Kqueue