C# Monitor File Activity

Question

I need to monitor a file for changes and see exactly where it has been modified.

It seems like I can't use FileSystemWatcher as I only get notified that a file has been modified but I can't know exactly what changed, and storing copies of the file to do a diff after the event is raised is not feasible since the file is really big.

I would like to implement something like what SysInternals have on their Process Monitor software, that tells us, for a WriteFile event, the modified part of the file given an offset and length.

I read that there is a Windows API that does this, but I couldn't find anything on how or where to start implementing it on a .net 3.5 application.

Answer 1

From what I have investigated, the .NET platform provides this event for handling file change events. However, this alone will not let you know what part of the file has changed.

You will need to store somewhere a copy of the file that is compared to the file whenever it changes, and then update that copy when the comparison is done. This is a very basic solution and can get really inefficient if the file is too large.

Answer 2

Using the FileSystemWatcher you can subscribe to the changed event ChangedEvent

FileSystemEventArgs contains a property FullPath which can be passed in to FileInfo. This will give you some basic file information, which can be stored to a database for example. You can keep a history of the file changes this way.

If you need to compare the content of the files it is more challenging and the approach will be different depending on file type.