10

I make program with spyware features for education, and I need to know in the program when file system is changing file, and what file is being changed.

How can I do that in C++?

Prakash K
  • 11,669
  • 6
  • 51
  • 109
lebron2323
  • 990
  • 2
  • 14
  • 29

2 Answers2

12

On Windows, look at SHChangeNotifyRegister(). Not only does it tell you what kind of change occured, but it also tells you which exact file(s) were changed.

Remy Lebeau
  • 555,201
  • 31
  • 458
  • 770
  • this work in window vista or seven? and how i can with this function get event when any file in filesystem or in some specific directory are changed? – lebron2323 Dec 07 '12 at 16:33
  • 1
    The last parameter specifies the folder(s) you want to monitor. To monitor the entire filesystem, either create an entry for each local drive letter (skip mapped drive letters), or a single entry whose path is set to NULL (but then you will receive notifications from all shell objects, not just the local filesystem). – Remy Lebeau Dec 07 '12 at 17:24
11

You are probably looking for Win32 Directory Change Notifications. There is also a .NET API called the FileSystemWatcher that exposes the same functionality.

The linked page gives a good example for subscribing to file system notifications. For more low-level access to filesystem changes you will have to look into Change Journals. That API is vastly more complicated so the first, directory change notifications, is probably your best place to start.

For the sake of mentioning it, the Linux kernel has a subsystem for this called inotifiy.

Sean Cline
  • 6,979
  • 1
  • 37
  • 50
  • Directory Change Notifications notify only when some file in whatched dir is created or removed. This is cool, Thanks! But i need some thing like this but for changing file content. – lebron2323 Dec 06 '12 at 13:39
  • 3
    It also allows you to see file changes in that tree using the [`FILE_NOTIFY_CHANGE_LAST_WRITE`](http://msdn.microsoft.com/en-us/library/windows/desktop/aa365465%28v=vs.85%29.aspx) flag. You will have to heed the warning regarding filesystem caching, however. – Sean Cline Dec 06 '12 at 14:49