Capture Delete Operation in Windows 7 (Preferred)

Question

I would like to capture delete operation in windows 7. If user deletes the file from computer, i need to store a record when the file is deleted and which file is deleted.

It is general file operation, not for particular folder or software. so lets say user deletes the file from d:\\testFolder\\test.txt I will get to know the file path and time when it is deleted.

Is it related to group policy programming? OR assembly programming?

Is there any way that any one can suggest? in C# Or C++ any language would be fine.

Answer 1

FileSystemWatcher can give some information, though you will not get information about which process or user performed the operation. Also some types of file deletion are not deletion but file movement operations and will be tracked differently. then some files are deleted by opening them with a special attribute and then closing them.

All those complicated cases can be tracked with a filesystem filter driver. You can write your own (kernel-mode programming experience is required) or you can use our CallbackFilter (free licenses are an option). For details about file deletion you can read this forum post .