Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 4 down vote favorite

I'm looking for some way or a tool that will give me a report and statistics of all the changes that happen on the filesystem over a period of time. For example I'd like to see all the files that were changed in some way over the past 15 minutes/1 hour/24 hours, etc.

I would like to do this on Windows Server 2003 R2 through 2008 R2.

share|improve this question
Are interested in files that are created but already deleted in your monitoring period? – Robert Nov 8 '11 at 18:49
That depends. Would a change like that be picked up by a volume snapshot on my EQL SAN? I would expect it to go unnoticed by the snapshot but that may not be true. – idon'twearsuits Nov 8 '11 at 20:39

2 Answers

up vote 5 down vote

"Everything" from Voidtools.com is a great solution for this. It attaches directly to the NTFS USN Journal and will see modifications that other utilities won't. It displays results in real time. Simply run it and go Search > Recent Changes > Last Hour (or Last 24 Hours). You can sort results too.

PS: Check out build 451 beta in the support forum, its the most recent build with updates to this feature.

share|improve this answer
Forum link: "Everything" version 1.2.1.451a – Miguel Angelo Nov 26 '12 at 17:24
up vote 4 down vote

There are three possibilities:

  1. Online: Monitor the changes online
  2. Offline 1: Use a tool that collects all information about the available files into a log file (e.g. a checksum file) at the beginning of the period and again at the end. Afterwards the logfiles can be compared to see what changes
  3. As NTFS supports snapshots (aka Volume Shadow Copies) you could manually create a shadow copy at the beguinning of the period and and the end compare both versions

Online Monitoring

The one-in-all tool for online monitoring is Sysinternals Proces Monitor (free) - however you you only want to see what changes configuration can be a bit difficult and I am not sure how stable it is for long term usage.

Offline Monitoring by "Checksum file"

Even if the name shows that it's primary focus is monitoring the Registry RegShot (GPL) also includes file comparison. There are other alternatives like SpyMe Tools and SystemSherlock Lite.

Offline Monitoring by Shadow Volume Copy

I don't know of any tool that would allow something like this. May be a talented programmer reads this and takes it as an idea for his next project?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.