Recently, many netizens asked questions about the monitoring of document system, and the 2 classes of 2 categories are needed to develop a background program to monitor changes in the entire file system. For example, the production, modification, movement, deletion, copying, once there is actions, the monitor can get the file name, address, and action type. This relatively simple, using the FindFirstChangeNotification, the approximate method is to write a while (1) to WaitFormultiPleObjects return value, the code is given after the code is the interception of the file operation;) the previous one is operational. In the future, this is that I agree before every operation, hahaha, hahaha, let's talk about realization, if you do this, FileMon must know, and you are ready to download Win2000 IFS SDK and Win2000 DDK, of course DriverStudio2.7 Also needed. This article (below) will introduce this development for Win9x / WinNT / Win2K / WinXP / WinNT / WIN2K / WINXP / WIN2003. Now write 1 code, you may be a bit bug yourself: the FindFirstChangeNotification function creates a change notification handle and set the initial change notification filtering condition. When a change that occurs in the specified directory or subdirectory, wait for the notification handle Successful. The prototype is: Handle FindfirstchanGenotification (lpctstr lppathname, // directory Bool BwatchSubtree, // Option DWORD DWNOTIFYFILTER // filter condition);
When one of the following occurs, the waitformultiPleObjects function returns 1. One or all specified objects in signal state 2. Arrival time
