File explorer maintains a record of a list of operations (copy, delete, move, new, rename) performed in the current explorer process, so that if you change your mind, you can undo the changes (Ctrl+Z) or redo the changes (Ctrl+Y).
I am using Windows 10 20H2, I have pinned undo and others to Quick Access Toolbar. And the edit button in the menu is greyed out.
The undo and redo buttons will be grey if there is nothing to be undone/redone, and will be blue if there are operations that can be undone/redone. When the undo/redo buttons are active, hovering the cursor over them will display a message that will show the specific action that can be undone/redone, and will show the filename of the file on which the operation is performed(Undo Move of File.txt). It will not show the filename if multiple files are involved(Undo Move).
The undo/redo history will be cleared if
explorer.exe is restarted, seems to indicate the history is stored in RAM; The history will also be cleared if one of the following three is performed:
1, Permanent deletion of a file (not moving to $RECYCLE.BIN); 2, Creating a shortcut and trying to undo creation of the shortcut after the shortcut is saved; 3, Performing a file operation that requires administrative privileges.
File operations performed by other programs(i.e. cmd, pwsh) will not be recorded in explorer's history.
Question: How can I view this file explorer operations history?
However none of them solves my problem, as
I am not trying to monitor file operations performed to a specific folder but rather all operations performed in current explorer process;
Process Monitor will only display operations performed after its launch, not before, and the number of events recorded increases really fast, thousands new events per second, most of them are by explorer.exe, and this is when I am not performing any operations, even if I filter by Process ID and view File Summary, a folder will be recorded even if the folder is only queried and not modified...