0

I found some software always check my files in my computer in backend. Any way to make an application to list which software have visited my files?

I need some ideas.
----------------
I just need general idea. I have no such experiences, and no idea, but I just seek any possible way to implement it. But I think it must have a way. OS: Windows. Language, not specify. better c#, c/C++

5
  • 4
    What do you mean by a software visiting files? I am trying to push the limits of my imagination and still cannot find a rational explanation of what you mean by this. Sep 29, 2011 at 7:39
  • 1
    Please clearify your question.
    – Baszz
    Sep 29, 2011 at 7:40
  • 1
    Are you looking for the process ID of all processes that have accessed your file? Are you looking for a path to the launcher for the file? Or perhaps are you looking for the current process name of those files? I don't think any of these things are possible, but you can at least monitor file events like @FlyBy advised (or inotify in Linux, you didn't specify a platform).
    – beatgammit
    Sep 29, 2011 at 8:08
  • @Darin Dimitrov, sorry for late reply. for example, I install an IM software in C drive, it should not visit my file in D drive, especially it's not the software related files. But the software iterate all files and collect my personal information, such as which software I am using.
    – iAsk
    Sep 29, 2011 at 9:19
  • @ tjameson, it's windows OS, for linux and Mac, it doesn't matter. for example, I specify a file and check which processes have visited it. (1) i am not looking for the process ID, coz I don't know which process will visit my file. (2) the path I can specify in my program. (3) I wanna get the visit history of one file.
    – iAsk
    Sep 29, 2011 at 9:26

4 Answers 4

1

You can use Procmon.exe (you can download it from here: http://technet.microsoft.com/en-us/sysinternals/bb896645 and find a tutorial here: http://www.k-state.edu/its/security/training/2009-4-9/presentations/handouts/Process_Monitor_Tutorial_Handout.pdf).

To monitor the access to your files simply add to the filter:

  • Event class is not File System then Exclude
  • Path is not "the path of your file" then Exclude

Then start to capture events (CTRL+E) and all the accesses to the file will be logged with the Process Name column telling you the executable that accessed it.

1
  • i used it before. but thanks for provide more information and I can filter my ideas which can do and which cannot do.
    – iAsk
    Sep 29, 2011 at 9:45
2

You can use Sysinternal's excellent Process Monitor tool for this. You can apply required filters so that you'll only see read/write accesses to the desired files. On the other hand, accomplishing the same programmatically may need a lot more labor.

1
  • ;-), I see. time-consuming. thanks for your great suggestion.
    – iAsk
    Sep 29, 2011 at 9:34
2

Are you using .NET? If yes, then you can use the FileSystemWatcher for that. Take a look here.

1
  • thanks very much. it's quite useful. it can be marked as answer as well
    – iAsk
    Sep 29, 2011 at 9:43
1

You can enable object access auditing for a folder which you want to monitor.Here is the link http://technet.microsoft.com/en-us/library/cc784387(v=ws.10).aspx

Than you need to use Eventviewer in windows machine where in windows logs->security you can see the events which are logged when folder content is accessed,changed(depends on settings while enabling object access auditing).Each log has fields Process name and Process id which you require.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .