Prev: Run-time error '20535'
Next: decompile exe
From: tslu69 on 12 Sep 2005 22:39
I am to write a program to track files copying activities on a PC. From what
I understand ReadDirectoryChangesW can only detect:

FILE_NOTIFY_CHANGE_FILE_NAM
FILE_NOTIFY_CHANGE_DIR_NAME
FILE_NOTIFY_CHANGE_ATTRIBUTES
FILE_NOTIFY_CHANGE_SIZE
FILE_NOTIFY_CHANGE_LAST_WRITE
FILE_NOTIFY_CHANGE_LAST_ACCESS
FILE_NOTIFY_CHANGE_CREATION
FILE_NOTIFY_CHANGE_SECURITY

In the case of files copying, does any of the above applies? Please direct
me.


From: Randy Birch on 13 Sep 2005 00:26
Copying to or from a drive?

--

Randy Birch
MS MVP Visual Basic
http://vbnet.mvps.org/
----------------------------------------------------------------------------
Read. Decide. Sign the petition to Microsoft.
http://classicvb.org/petition/
----------------------------------------------------------------------------



"tslu69" <tslu69(a)yahoo.com> wrote in message
news:%233ZFYxAuFHA.1256(a)TK2MSFTNGP09.phx.gbl...
:I am to write a program to track files copying activities on a PC. From
what
: I understand ReadDirectoryChangesW can only detect:
:
: FILE_NOTIFY_CHANGE_FILE_NAM
: FILE_NOTIFY_CHANGE_DIR_NAME
: FILE_NOTIFY_CHANGE_ATTRIBUTES
: FILE_NOTIFY_CHANGE_SIZE
: FILE_NOTIFY_CHANGE_LAST_WRITE
: FILE_NOTIFY_CHANGE_LAST_ACCESS
: FILE_NOTIFY_CHANGE_CREATION
: FILE_NOTIFY_CHANGE_SECURITY
:
: In the case of files copying, does any of the above applies? Please direct
: me.
:
:

From: tslu69 on 13 Sep 2005 00:28
Any files that are copied out of a PC

"Randy Birch" <rgb_removethis(a)mvps.org> wrote in message
news:u5FZRtBuFHA.1256(a)TK2MSFTNGP09.phx.gbl...
> Copying to or from a drive?
>
> --
>
> Randy Birch
> MS MVP Visual Basic
> http://vbnet.mvps.org/
> ----------------------------------------------------------------------------
> Read. Decide. Sign the petition to Microsoft.
> http://classicvb.org/petition/
> ----------------------------------------------------------------------------
>
>
>
> "tslu69" <tslu69(a)yahoo.com> wrote in message
> news:%233ZFYxAuFHA.1256(a)TK2MSFTNGP09.phx.gbl...
> :I am to write a program to track files copying activities on a PC. From
> what
> : I understand ReadDirectoryChangesW can only detect:
> :
> : FILE_NOTIFY_CHANGE_FILE_NAM
> : FILE_NOTIFY_CHANGE_DIR_NAME
> : FILE_NOTIFY_CHANGE_ATTRIBUTES
> : FILE_NOTIFY_CHANGE_SIZE
> : FILE_NOTIFY_CHANGE_LAST_WRITE
> : FILE_NOTIFY_CHANGE_LAST_ACCESS
> : FILE_NOTIFY_CHANGE_CREATION
> : FILE_NOTIFY_CHANGE_SECURITY
> :
> : In the case of files copying, does any of the above applies? Please
> direct
> : me.
> :
> :
>


From: Jeff Johnson [MVP: VB] on 13 Sep 2005 09:15
"tslu69" <tslu69(a)yahoo.com> wrote in message
news:e76gouBuFHA.3720(a)TK2MSFTNGP14.phx.gbl...

>> Copying to or from a drive?

> Any files that are copied out of a PC

Hmmm. My guess is that the only possible item that might apply is:

>> : FILE_NOTIFY_CHANGE_LAST_ACCESS

Sounds like you're more in need of physical security than programmatic
security.


From: J French on 14 Sep 2005 09:08
On Tue, 13 Sep 2005 10:39:17 +0800, "tslu69" <tslu69(a)yahoo.com> wrote:

>I am to write a program to track files copying activities on a PC. From what
>I understand ReadDirectoryChangesW can only detect:
>
> FILE_NOTIFY_CHANGE_FILE_NAM
> FILE_NOTIFY_CHANGE_DIR_NAME
> FILE_NOTIFY_CHANGE_ATTRIBUTES
> FILE_NOTIFY_CHANGE_SIZE
> FILE_NOTIFY_CHANGE_LAST_WRITE
> FILE_NOTIFY_CHANGE_LAST_ACCESS
> FILE_NOTIFY_CHANGE_CREATION
> FILE_NOTIFY_CHANGE_SECURITY

>In the case of files copying, does any of the above applies? Please direct
>me.

File copying is not a single operation
- it is a series of ops - open, create, read, write, set date(s), set
atrib, close

Grab a copy of FileMon from SystemInternals and watch what happens

 | 
Pages: 1
Prev: Run-time error '20535'
Next: decompile exe