How to catch the details of the file copy/move event, such as the source file name

Question

Just want to write a application to track the relationship between the files in the disk.

We know that FileSystemWatcher can fire evetns when creating, renaming or deleting the file.

But FileSystemWatcher can not tell us the path of the source file.

For example, let's say there is a file F1 in the folder1, and then we copy F1 to another folder named folder2, the new file name is still F1. In this case the FileSystemWatcher could tell us there is a new file has been created in folder2. But it can not tell us the new F1 is copied from the F1 in folder1, while this information is what we need.

Any thoughts?

Answer 1

This is because there is no such operation as "copy a file", as far as the filesystem is concerned.

When you run a file copying command, it actually opens the old file, creates the new file, reads content into memory, writes to the new files, then closes both. All the filesystem sees are writes; there's no taint-tracking system for determining that the data actually came from another file without modification.

The final step, that differentiates the file copy from writing data to a file normally, is that the metadata of the destination are changed to match the source. But again, the filesystem doesn't know why you're changing the attributes or which file you're matching them two.

The filesystem only has special awareness of linking and unlinking. So moving, which consists of "create second link to content; remove first link" is detectable. If copying were implemented as "create new link marked for copy-on-write" then you could discover it, but copy-on-write is not a very popular filesystem feature.