How to find out when and which files were changed on a Windows file system using winapi

Question

I am making a program with spyware functions for training, and I need to know in the program when the file system changes the file and which file changes.

How can I do this in C ++?

Answer 1

On Windows, view SHChangeNotifyRegister() . Not only does it tell you what changes have occurred, but it also tells you what exact files were changed.

Answer 2

You are probably looking for Win32 Directory Change Notifications . There is also a .NET API called FileSystemWatcher that provides the same functions.

The linked page provides a good example for subscribing to file system notifications. For lower access to file system changes, you will need to study Modify Logs . This API is much more complex, so the first notifications of directory changes are probably your best place to start.

To mention this, the Linux kernel has a subsystem for this inotifiy .