FileSystemWatcher, File Deletion Question

[chaddix]

Hi everyone, before I ask my question, I just want to say that I'm very new to .net programming but very willing to learn. So please...be gentle...

My organization needs to monitor file changes over a network. I wrote a program in VB.NET that works great. If a user either renames or deletes a file, the program will record the activity in a log (text file).

Here is what I want the program to do: If a user deletes a file, I want the program to archive a copy of the file being deleted...if the user makes a mistake and deletes something from the network that shouldn't have been deleted, I can check the log (which will contain the archived name of the file) and restore the file easily. Unfortunately, the nature of the program as written waits for the Delete Event from FileSystemWatcher, meaning that by the time any code is executed, the file has already been deleted, and any opportunity to archive the file has left the building.

Any ideas? Thanks everyone!

 

[cjard]

Yeah, um.. that's why we have the little old concept of "backups" and "windows nt file system permissions"

!

 

[chaddix]

Wow, backups and permissions, what a novel idea, I wish I'd thought of that...dws

Permissions - We allow select people to have deletion rights because that's part of their job; from time to time, they have to delete a file. That doesn't mean they always do it correctly.

Backups - We have rotating backups; we're talking about a massive amount of information, so we only have tapes going back about a week. There are times when we don't know the file has been erroneously deleted for weeks/months.

 

[cjard]

OK, so tell me..

If you get a notification that a file has been deleted, after it has been deleted, how do you propose to stop it happening?

Asked another way: When you picked up a newspaper on 12th September 2001 and read that the World Trade Centre had fallen down, what did you do to prevent it happening?

If you figure out how to stop a delete after it happened, let me know because I might be able to expand the concept in all sorts of useful money making ways.. For now, you might just have to record all those deletes in a table and when someone wants a file that is not there, consult the table for what heppened, and restore a backup as necessary

Side note, as we have found in this company: We actually have a 2TB usb hard disk plugged in as hot-backup in addition to the ordinary backup. Once a day, new and changed files are copied to it (changed overwrite existing) and it's far more easily accessible than the tape backups that we also keep.. I dont know how big your data is, but we've found this to be very useful and I think the drive cost less than 1 tape.. an amusing twist of supply and demand, it seems. We also rarely, if ever, delete anything.. The cost of storing the info, at today's prices, is far cheaper than the total cost of restoring something that was deleted

 

[chaddix]

On September 12th, I went to the Orchid station and moved the island to try to travel back in time and prevent September 11th, but unfortunately, moving the island sent me forward in time, not backwards, so now I can never go back to the island...ok, that's enough of that, I watch WAY to much TV, especially Lost...

Back to the issue at hand...what I was hoping the program could do is one of two things: (1) Utilize some sort of undelete function, which assumes that the hard drive space was not immediately reallocated; (2) When the file is deleted, the program pulls a Lee Corso and says "not so fast my friend", stops the delete, runs through the program, and then deletes the file programmatically. You're right...we figure out how to do that, and that's a nice money maker.

Thanks for the advice about tapes v. hard drives...hard drives are getting insanely cheap now and accessing the data is much easier. I'm not sure exactly how the backup operates (another branch of IT does it, I'm more development) I just know that this arose because we did not have a backup going back to February when the initial delete event occurred (we saw that it had been deleted in May). The whole point is that 99 out of 100 times, when a file is deleted, it is appropriate; that 1 time though is the issue, and we wouldn't even know it was inappropriate until well after the fact (three months in this case). How do we know if was inappropriate and why didn't we know it sooner? Well, that's the nature of the business, and it would take paragraphs for me to explain, so we'll just leave it at that...

Thanks again!

 

[cjard]

I was only on Season 4 episode 11. Cheers for that.

As for hooking the delete function.. youre gonna have to get waay down and dirty into the OS API for that. I dont know where I would even start.. The supernerd C++ forums on CodeGuru probably..

You might be able to find someone who already did it; we had a similar complaint recently and the tool we found was...
Umm..

http://www.poweradmin.com/file-sight/

Maybe it will help?

I seem to recall checking the price to be a measly $200.. simply put, they couldnt pay me $200 to replicate that functionality so it was cheaper to buy it in.. You might also be able to find a util that makes network deletes delete to recycle bin instead of just stright out killing the file, i dunno..

 

[cjard]

pps; the concept of time travel is for movies; there isnt enough memory in the universe to remember where every atom is at every fractional moment in time, with enough accuracy to be able to put them all back in an instant in order to cause "time travel"

siply put; time as a scrollable dimension doesnt exist - it's a concept invented by humans to schedule for atoms and molecules to be proximal in order that interactions can take place, nothing more

 

[chaddix]

I'll definately check the program out...like you said, $200 is pretty cheap. It does sound way to supernerd for me...

I hope I didn't give anything away about the show that wasn't in the previews...my apologies if I did. If its any consolation, even after watching the whole season, I'm completely lost...