monitor file/directory access in C#

Question

I want to develop the application which logs the files / directories accessed on the machine.

e.g. I go to D:\ and into a folder documents and open a word file. I want my application to create a log in the following format:

D:\ Opened
D:\documents Opened
D:\documents\secret.docx Opened

I've used FileSystemWatcher to achieve the other type of file system activity but unable to get events for accessing this.

I fear that you won't be able to do this without very low level WinAPI hooks into the kernel. — Daniel Hilgarth, Aug 24 '11 at 15:21

score 3 · Answer 1 · edited May 23 '17 at 12:28

3

sounds like you wanna do a FileMon program like sys internals. in their website Mark tells about the way FileMon works so you can get some inspiration by reading the article.

also see here: How do you monitor file access and changes on a file server by user name?

edited May 23 '17 at 12:28

Community

1
1

answered Aug 24 '11 at 15:24

Davide Piras

43,984
10
98
147

score 1 · Answer 2 · answered Aug 24 '11 at 15:21

Not sure this sort of monitoring can be achieved with filesystemwatcher as it is aimed at monitoring changes I believe. You could use filesystem Auditing (by going into advanced security settings) which will log events in eventlog and you can pull it from there.

score 0 · Answer 3 · answered Aug 24 '11 at 16:20

0

Most viable option is use of file system filter driver. Such driver gives you fine-grain control over all requests going to particular file system. The only issue with this approach is complexity of developing such driver in kernel mode.

answered Aug 24 '11 at 16:20

Eugene Mayevski 'Callback

45,135
8
71
121

monitor file/directory access in C#

3 Answers3