Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I found some software always check my files in my computer in backend. Any way to make an application to list which software have visited my files?

I need some ideas.
----------------
I just need general idea. I have no such experiences, and no idea, but I just seek any possible way to implement it. But I think it must have a way. OS: Windows. Language, not specify. better c#, c/C++

share|improve this question

migrated from stackoverflow.com Oct 1 '11 at 2:15

This question came from our site for professional and enthusiast programmers.

3  
What do you mean by a software visiting files? I am trying to push the limits of my imagination and still cannot find a rational explanation of what you mean by this. –  Darin Dimitrov Sep 29 '11 at 7:39
1  
Please clearify your question. –  Baszz Sep 29 '11 at 7:40
1  
Are you looking for the process ID of all processes that have accessed your file? Are you looking for a path to the launcher for the file? Or perhaps are you looking for the current process name of those files? I don't think any of these things are possible, but you can at least monitor file events like @FlyBy advised (or inotify in Linux, you didn't specify a platform). –  tjameson Sep 29 '11 at 8:08
    
@Darin Dimitrov, sorry for late reply. for example, I install an IM software in C drive, it should not visit my file in D drive, especially it's not the software related files. But the software iterate all files and collect my personal information, such as which software I am using. –  iAsk Sep 29 '11 at 9:19
    
@ tjameson, it's windows OS, for linux and Mac, it doesn't matter. for example, I specify a file and check which processes have visited it. (1) i am not looking for the process ID, coz I don't know which process will visit my file. (2) the path I can specify in my program. (3) I wanna get the visit history of one file. –  iAsk Sep 29 '11 at 9:26
add comment

3 Answers

up vote 1 down vote accepted

You can use Procmon.exe (you can download it from here: http://technet.microsoft.com/en-us/sysinternals/bb896645 and find a tutorial here: http://www.k-state.edu/its/security/training/2009-4-9/presentations/handouts/Process_Monitor_Tutorial_Handout.pdf).

To monitor the access to your files simply add to the filter:

  • Event class is not File System then Exclude
  • Path is not "the path of your file" then Exclude

Then start to capture events (CTRL+E) and all the accesses to the file will be logged with the Process Name column telling you the executable that accessed it.

share|improve this answer
    
i used it before. but thanks for provide more information and I can filter my ideas which can do and which cannot do. –  iAsk Sep 29 '11 at 9:45
add comment

Are you using .NET? If yes, then you can use the FileSystemWatcher for that. Take a look here.

share|improve this answer
    
thanks very much. it's quite useful. it can be marked as answer as well –  iAsk Sep 29 '11 at 9:43
    
You are welcome... : ) –  FlyBy Sep 29 '11 at 9:44
add comment

You can use Sysinternal's excellent Process Monitor tool for this. You can apply required filters so that you'll only see read/write accesses to the desired files. On the other hand, accomplishing the same programmatically may need a lot more labor.

share|improve this answer
    
;-), I see. time-consuming. thanks for your great suggestion. –  iAsk Sep 29 '11 at 9:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.