Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for a tool that can give me a timeline of all changes that where applied to the files in a given directory, together with the contents of all files at any given point.

This cannot be handled (as far as I know) by any backup solution as they all check regularly, but not continuously if a change was applied. For my purpose it is important that I catch every change, not just the state after a given interval.

The directory I need to monitor will be fairly small, less then one MB and les then 200 files. The write activity will be spread out but there might be short bursts with a few writes per second. And, just to clarify, if a file changes twice within a single second, I need both versions.

Also, the write access to the files is done in an "open - write - close" pattern, so there are no long lasting file locks to contend with.

Performance is not a concern. Even if the write time doubles, that would still be okay.

The operating system is either Windows 7 or Mac OS 10.6. The process itself runs under Windows but writing to a share on the Mac is not a problem.

The writing process is not really a single process. There are multiple programs involved that all could apply changes.

share|improve this question
what is the process writing these files? – dawud Jul 15 '13 at 19:40
You could have ReadDirectoryChangesW events triggering diskshadow snapshots, and then copy the changed files. But I don't know if there would be race conditions with your bursts of writes. Change journals can be interesting too. – Paulo Almeida Jul 15 '13 at 20:28
@PauloAlmeida, thanks. Change journals are useful to detect a change since you last checked but do not guarantee every change being caught. ReadDirectoryChangesW as well as FindFirstChangeNotification seem to be promising at first, but they react to an actual write to disk rather then a file change that might be a cache only write. So, I guess I need something in between the disk and the application, like a filter driver. I was hoping for an existing app somewhere. Alternatively a good tutorial on filter drivers would work too. – Sebastian Meine Jul 16 '13 at 2:24
I did notice the cache problem with the WRITE events of ReadDirectoryChangesW, but there is FILE_NOTIFY_CHANGE_LAST_ACCESS, which might get around that. – Paulo Almeida Jul 16 '13 at 7:20

The best of the best:

  • MOGWare. FileHamster


Good luck!

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .