Watch a folder for reading files

Question

I am trying to look at files in a directory to determine when files are open / available. I thought FileSystemWatcher would do the trick using the Changed event.

The problem is that some applications do not create a lock on the file they open / access, or change either the modification date or the access date (even after fsutil behavior set disablelastaccess 0 ). For example, Notepad. Apparently, he makes a copy of the file in memory and plays with it there until you save it. Also, it does not update the access date.

How to control the file directory and receive notifications that the file simply opens or is opened by some program (for example, Notepad)? Files can be opened from another computer, not necessarily launching an “observer” on the computer.

I found many similar questions, but did not see anyone focusing on file access.

Answer 1

It's quite normal. Updating an existing file is quite dangerous because it can lead to permanent data loss. A disk error (such as a full disk) during recording is very bad news. General algorithm used:

• rename source file
• write a new file using the original name
• no error: delete the renamed file
• Error: delete new file, rename original file back

Obviously, this does not cause the Changed event to be raised, not a single file has been modified.

---

Sorry, I didn’t read the question well enough. There is no notice that the application is simply opening the file for reading. FSW can detect changes in the file system. There is also no ready-made alternative; this requires a special file system filter driver that monitors driver requests. Similar to what the ProcMon SysInternals utility uses. I don’t know which driver is ready for use in a C # program, you also cannot write them in C #. This is simply not a general requirement.