How to know when and which files are changed in windows filesystem with winapi

Question

I make program with spyware features for education, and I need to know in the program when file system is changing file, and what file is being changed.

How can I do that in C++?

Answer 1

You are probably looking for Win32 Directory Change Notifications. There is also a .NET API called the FileSystemWatcher that exposes the same functionality.

The linked page gives a good example for subscribing to file system notifications. For more low-level access to filesystem changes you will have to look into Change Journals. That API is vastly more complicated so the first, directory change notifications, is probably your best place to start.

For the sake of mentioning it, the Linux kernel has a subsystem for this called inotifiy.

Answer 2

On Windows, look at SHChangeNotifyRegister(). Not only does it tell you what kind of change occured, but it also tells you which exact file(s) were changed.