在文件资源管理器中检测并记录复制/粘贴/删除/剪切操作

Question

I want to detect and log to file Explorer operations such as copy/cut/delete/paste.

I have read about FileSystemWatcher , but I also noticed it has some issues since there is no copy/cut events available which can be confusing with whatever I want to do.

The operating system and FileSystemWatcher object interpret a cut-and-paste action or a move action as a rename action for a folder and its contents. If you cut and paste a folder with files into a folder being watched, the FileSystemWatcher object reports only the folder as new, but not its contents because they are essentially only renamed.

FileSystemWatcher is hooking the create file and delete file events to the changed and renamed events which can't really help me to determine if it was made by the user or some another process. Furthermore I cannot be 100% sure what happened to the file whether it was copied or cut etc.

I also need to keep track of the locations "from/to" and the name of file.

Is there some alternative to the FileSystemWatcher that can distinguish between these actions?

Answer 1

I think the FileSystemWatcher would be of use in this scenario. You could use the Changed event, which occurs when a file or directory is changed - like a copy/paste action.

See the MSDN Documentation for this event, and the class itself. Note that there are other events that you can also use for the delete/cut actions.

The events use the FileSystemEventArgs which contains properties for FullPath and Name .