Monitor files similar to System Internal's/Microsoft's FileMon/Process Monitor

Question

I need to generate an event when a file is closed by another app.

Unfortunately, ReadDirectoryChangesW doesn't report the close event. It would be possible for me to poll (with a TTimer) any file that reported by ReadDirectoryChangesW as modified, waiting for it to be closed (using CreateFile to detect this).

However, what I'd prefer is a completely event driven solution.

Is there a way to hook system calls and detect all file closing events? I simply want to know the path & name of any file that has just been closed.

Answer 1

There is no good simple solution to your problem in Delphi alone - the real solution is to write a filter driver to monitor file closing events.