Monitor files similar to System Internal's/Microsoft's FileMon/Process Monitor

Posted by Tom1952 on Stack Overflow See other posts from Stack Overflow or by Tom1952
Published on 2010-03-27T06:13:25Z Indexed on 2010/03/27 6:23 UTC
Read the original article Hit count: 763

Filed under:

I need to generate an event when a file is closed by another app.

Unfortunately, ReadDirectoryChangesW doesn't report the close event. It would be possible for me to poll (with a TTimer) any file that reported by ReadDirectoryChangesW as modified, waiting for it to be closed (using CreateFile to detect this).

However, what I'd prefer is a completely event driven solution.

Is there a way to hook system calls and detect all file closing events? I simply want to know the path & name of any file that has just been closed.

© Stack Overflow or respective owner

Related posts about delphi