Member Avatar for crazyboy

hi friends ...
i want help regarding file management in windows.

what i want to do is ,
Keep track of all files and folders created or deleted during a period of time.

for example ,
during 5 to 6 pm somebudy else is using my computer. so at that time
i want to track whatever action performed by that user reagarding files like deletion of some file or creation of some files etc.

i have done a lot googling but not ot any solution.
i also tried to get through system message queue.but still i m not getting wht i want.

any one knows how can i achieve this??
i just want to track that creation and deletion of file in database.

or

any one knows wht actually happen in system when user create any file or delete any file.i mean wht apis are call wht processes are called??

  • 2 Contributors
  • 3 Replies
  • 207 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by crazyboy

Dani AI

Generated

As suggested, using a watcher is the right approach — but clarify the scopes and limits. A watcher (for example the .NET FileSystemWatcher) watches whatever root path it is attached to; setting IncludeSubdirectories = true will recurse under that root, but it will not magically watch other drive letters or unrelated roots — one watcher per root (or schedule multiple paths) is required. The watcher is a managed wrapper around the Win32 API ReadDirectoryChangesW, so it inherits the same buffering/overflow behavior and network limitations. (learn.microsoft.com)

If the goal is “who did it” as well as “what changed,” FileSystemWatcher (or ReadDirectoryChangesW) does not provide the account name. Windows security auditing (enable the Audit File System / Object Access policies and set SACLs on the folders) is the supported way to get user-level events (Security event log entries such as object-deleted / object-access events). That approach produces audited events that include account information but can generate a lot of log volume. (learn.microsoft.com)

For high-volume or volume-wide history, the NTFS USN (change) journal is a more reliable source than change-notification buffers: it records every change on an NTFS volume and can be read programmatically (DeviceIoControl / FSCTL_READ_USN_JOURNAL), although it does not record the user that caused the change. It requires NTFS and appropriate privileges. (learn.microsoft.com)

A practical Python pattern: use the watchdog library to receive recursive events, push lightweight event records into a thread-safe queue, and let a background worker batch writes to the database. This decouples event handling from I/O and helps avoid missed notifications under load.

from watchdog.observers import Observer
from watchdog.events import FileSystemEventHandler
import queue, threading, sqlite3, time

q = queue.Queue()

class H(FileSystemEventHandler):
    def on_created(self, e): q.put(('created', e.src_path, time.time()))

def writer():
    db = sqlite3.connect('changes.db', check_same_thread=False)
    db.execute('CREATE TABLE IF NOT EXISTS events(type,path,ts)')
    while True:
        t,p,ts = q.get()
        db.execute('INSERT INTO events VALUES (?,?,?)',(t,p,ts)); db.commit()
        q.task_done()

threading.Thread(target=writer, daemon=True).start()
o = Observer(); o.schedule(H(), 'F:\\', recursive=True); o.start()
try: time.sleep(1e9)
finally: o.stop(); o.join()

Watchdog is a mature Python option for cross-platform watching; see its docs for observer choices and polling fallbacks. Handle created/modified races with small retries, monitor for watcher error events (buffer overflow), and use auditing or USN journal when user attribution or guaranteed volume-level history is required. (github.com)

Recommended Answers

All 3 Replies

Member Avatar for kvprajapati

From MSDN online page - FileSystemWatcher Class.

SUMMARY:
It listens to the file system change notifications and raises events when a directory, or file in a directory, changes.

Member Avatar for crazyboy

thnks for ur reply ..
i m trying it right now ...

Member Avatar for crazyboy

hi again ..
it working up to one layer ..
i mean if i have givenpath like "F:\"

thn its give me changes from F:\ and subdirectiesof F but not other than that ..

still its helpful for me ..
and one more que...

can i display full path which is there in address bar of my computer in the title bar of that my computer window??

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.