File System Filter Driver for Specific File Types

Question

I need to detect when either of the two file types is somehow implemented through the entire Windows file system.

As I understand it, the only way to do this without major slowdowns for the operating system is to create a file system filter driver?

Essentially, all I have to do is grab a copy of any doc (x) and pdf files that open. I decided to use this approach, as it was either, or use file monitors in C # that would not be effective for the entire drive.

My question is twofold, is there an easier way, and secondly, how could I just take a copy of each doc (x) / pdf file as it is accessed?

The solution needs to be deployed with the package that we are currently producing.

UPDATE

I am going to evaluate the observer of the file system by discussing it with people here, I think it is possible, that it can be acceptable, my concern is that I need to control the common user directories where the downloads will take place (like "C: \ Users \ SomeUser * ", as well as the temporary Outlook folder.

Answer 1

You will need to create a file system watcher. Here is an example of code that will monitor changes to docx files.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.IO;
using System.Security.Permissions;

namespace filewatchtest
{
    class Program
    {
        static void Main(string[] args)
        {
            Run();
        }

        [PermissionSet(SecurityAction.Demand, Name="FullTrust")]
        public static void Run()
        {
            string[] args = System.Environment.GetCommandLineArgs();

            // if directory not specified then end program
            if (args.Length != 2)
            {
                Console.WriteLine("Usage: filewatchtest.exe directory");
                return;
            }

            // create a new fileSystemWatcher and set its properties
            FileSystemWatcher watcher = new FileSystemWatcher();
            watcher.Path = args[1];

            // set the notify filters
            watcher.NotifyFilter = NotifyFilters.LastAccess | NotifyFilters.LastWrite | NotifyFilters.FileName | NotifyFilters.DirectoryName;

            // set the file extension filter
            watcher.Filter = "*.docx";

            // add event handlers
            watcher.Changed += new FileSystemEventHandler(OnChanged);
            watcher.Created += new FileSystemEventHandler(OnChanged);
            watcher.Deleted += new FileSystemEventHandler(OnChanged);
            watcher.Renamed += new RenamedEventHandler(OnRenamed);

            // bengin watching
            watcher.EnableRaisingEvents = true;

            // wait for the user to quit the program
            Console.WriteLine("Plress q to quit the program");
            while (Console.Read()!='q');


        }

        static void OnRenamed(object sender, RenamedEventArgs e)
        {
            Console.WriteLine("File: {0} renamed to {1}", e.OldFullPath, e.FullPath);
        }

        static void OnChanged(object sender, FileSystemEventArgs e)
        {            
            Console.WriteLine("File:" + e.FullPath + " " + e.ChangeType);
        }



    }
}

Answer 2

I think that creating a copy while reading will cause a lot of problems. For example: antivirus scanners. Consider the following:

• I open the file "test.pdf"
• Your program creates "test_copy.pdf"
• () "test_copy.pdf"
• "test_copy_copy.pdf"
• ...

, , READ . 10 , , , -, . 10 ?

/. , , , , .

. docx , "~ $_____. Docx", PDF. , , . . , . docx PDF , , .

, read access, - , . , .

, " " , , . .

Answer 3

, , Watcher , , . , " " , , .

ETW - Windows, . .

, , Alpha Volume Shadow Copies , .

Conclusion: the filter driver is probably unnecessary and does not allow you to get away from other problems, although I admit that the description of hierarchical storage management systems can suit your approach, considering the load store to be the next hierarchy after the hard drive.