HOWTO：监控Windows中其他进程的文件访问？

Question

I am working on a program that processes image files. The problem I am running into is some of the images are very large and I don't know when the copy process is done. Right now the code is written in C# and is using the FileSystemWatcher class to monitor the files. The only problem is there is no event for when another process is DONE with the file.

The current logic is to watch for created and changed events and than wait 5 seconds in hopes that by that point in time the copy process is done. While this works on my development machine, unfortunately customers report issues with the whole process.

Years ago when I wrote this code I did see that at a lower level, I think it was part of the DDK SDK or something, it is possible to find out a lot more information about how another program is accessing a file.

Can anyone speak into this and point me in the right direction? I do expect it to be C++ code, not C# code.

---

To answer some questions below:

The issue is that OTHER processes are copy images into directories that my program is monitoring. Once the images are fully copied my program needs to start processing the images as soon as possible. The issue is that many images, at times hundreds of images, will be copied at one time. Since each image needs to be processed as fast as possible, the system needs to know as soon as possible that the image is fully copied and can be processed.

I am fully aware there is NO way to do what I want to do via the WinSDK, but I am 99.9% sure it IS possible via the WinDDK, maybe I have the name wrong, I Googled that and got "Windows Driver Kit (WDK)". I am pretty sure the way SysInternals pulls off all their cool tricks is by using WDK level functions.

Answer 1

What you might be interested in is sys internals procmon tool. Among other functionality it monitors file access giving you a lot of details. Unfortunately sources are not available but here's a thread about previous version (filemon) started by somebody with an issue similar to yours.

Also you may want to look into open source alternative , it may have the code you are looking for.

Alternatively you can use ProcMon as a monitor tool and parse its output. Using built in filter functionality you'll be able to limit your log file entries to specific folder and type/data of file access event.

---

[ Update ]

Recently I had a chance to revisit this issue for one of my projects, what I found is that call

File.Open(filePath, FileMode.Open, FileAccess.Read, FileShare.None)

will throw IOException if file is still used by another process.

So what you can do is after you get Created notification from FileSystemWatcher call File.Open every couple of seconds, once you stop getting exception you know that another process is done with the file.