Monitor files similar to System Internal's/Microsoft's FileMon/Process Monitor
- by Tom1952
I need to generate an event when a file is closed by another app.
Unfortunately, ReadDirectoryChangesW doesn't report the close event. It would be possible for me to poll (with a TTimer) any file that reported by ReadDirectoryChangesW as modified, waiting for it to be closed (using CreateFile to detect this).
However, what I'd prefer is a completely event driven solution.
Is there a way to hook system calls and detect all file closing events? I simply want to know the path & name of any file that has just been closed.