up vote 0 down vote favorite
share [g+] share [fb]

I found some software always check my files in my computer in backend. Any way to make an application to list which software have visited my files?

I need some ideas.
----------------
I just need general idea. I have no such experiences, and no idea, but I just seek any possible way to implement it. But I think it must have a way. OS: Windows. Language, not specify. better c#, c/C++

link|improve this question
3  
What do you mean by a software visiting files? I am trying to push the limits of my imagination and still cannot find a rational explanation of what you mean by this. – darin Sep 29 '11 at 7:39
1  
Please clearify your question. – Baszz Sep 29 '11 at 7:40
1  
Are you looking for the process ID of all processes that have accessed your file? Are you looking for a path to the launcher for the file? Or perhaps are you looking for the current process name of those files? I don't think any of these things are possible, but you can at least monitor file events like @FlyBy advised (or inotify in Linux, you didn't specify a platform). – tjameson Sep 29 '11 at 8:08
@Darin Dimitrov, sorry for late reply. for example, I install an IM software in C drive, it should not visit my file in D drive, especially it's not the software related files. But the software iterate all files and collect my personal information, such as which software I am using. – iAsk Sep 29 '11 at 9:19
@ tjameson, it's windows OS, for linux and Mac, it doesn't matter. for example, I specify a file and check which processes have visited it. (1) i am not looking for the process ID, coz I don't know which process will visit my file. (2) the path I can specify in my program. (3) I wanna get the visit history of one file. – iAsk Sep 29 '11 at 9:26
feedback

migrated from stackoverflow.com Oct 1 '11 at 2:15

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 1 down vote accepted

You can use Procmon.exe (you can download it from here: http://technet.microsoft.com/en-us/sysinternals/bb896645 and find a tutorial here: http://www.k-state.edu/its/security/training/2009-4-9/presentations/handouts/Process_Monitor_Tutorial_Handout.pdf).

To monitor the access to your files simply add to the filter:

  • Event class is not File System then Exclude
  • Path is not "the path of your file" then Exclude

Then start to capture events (CTRL+E) and all the accesses to the file will be logged with the Process Name column telling you the executable that accessed it.

link|improve this answer
i used it before. but thanks for provide more information and I can filter my ideas which can do and which cannot do. – iAsk Sep 29 '11 at 9:45
feedback
up vote 2 down vote

You can use Sysinternal's excellent Process Monitor tool for this. You can apply required filters so that you'll only see read/write accesses to the desired files. On the other hand, accomplishing the same programmatically may need a lot more labor.

link|improve this answer
;-), I see. time-consuming. thanks for your great suggestion. – iAsk Sep 29 '11 at 9:34
feedback
up vote 2 down vote

Are you using .NET? If yes, then you can use the FileSystemWatcher for that. Take a look here.

link|improve this answer
thanks very much. it's quite useful. it can be marked as answer as well – iAsk Sep 29 '11 at 9:43
You are welcome... : ) – FlyBy Sep 29 '11 at 9:44
feedback

Your Answer

 
or
required, but never shown
discard