Logging Transferred Files

[Jay1b]

Hi

I would like to write a service which monitors all files transferred to and from a USB flash drive.

I know how to read the drives every x amount of seconds, check what 'type' of drive they are (CD, HD, Removeable). I could run through all the files and directories on the removeable drive and take a list of them, then on the next cycle take another list, and play spot the difference. By checking the times, I can tell if more files have been added to the USB drive.

However it would be good, to somehow log all of the files which are transferred from the USB key as well, and short of logging the contents of every drive (which obviously isnt practical), I dont know how to do it. Is there something in Windows I could tie in with?

Any tips/advice would be great thanks

Jay

 

[JohnH]

Loop up about the FileSystemWatcher component.

 

[Jay1b]

Thanks, I will do

 

[Jay1b]

I managed to get the FileSystemWatcher working rather easily, and it monitors the USB Flash drive excellently and logs any changes into an SQL Server database.

However, it locks the USB Flash Drive, so when you try to stop the drive before removing it, its unable to do so because 'its currently in use'. Is there anyway around this problem? As it kind of renders it unusable currently

Thanks

 

[JohnH]

There is, but it is fairly advanced using lots of Win32 stuff. There is a "starter" for what this is about in this thread: http://www.vbdotnetforums.com/showthread.php?t=24334, it's the WM_DEVICECHANGE message which is sent to all top windows for all arrivals/removals (DBT_DEVICEARRIVAL and DBT_DEVICEREMOVECOMPLETE events), but the interesting event DBT_DEVICEQUERYREMOVE is only sent to your window if your application holds a file lock and also has registered for notification with RegisterDeviceNotification method. So to have a chance at this you have to open a file for writing or reading and keep it open as long as necessary, which is trivial since you are holding a lock now anyway. I have some working code for this and will put together sample and post it here later.

 

[JohnH]

I discovered this was a Windows Service request only after my previous post. This would not be a problem since WM_DEVICECHANGE is sent as SERVICE_CONTROL_DEVICEEVENT in services when registered properly, but the managed ServiceBase has a flaw; custom commands only expose the message number and not the vital parameters. With a lot of research I have not yet found any workarounds, trying to set up a second service message loop with RegisterServiceCtrlHandlerEx and a "fake" service name actually succeeds but the service crashes shortly afterwards. (SetServiceStatus is handled correctly, so that is not the problem.)
So I decided to post the attached Winforms project that displays how it works instead. The sample is targeted for a single drive I set in const variable sampleDrive. Project feature a Win32 class with the necessary declarations, a filelocknotify class to handle a file write lock and registering for notifications on this handle, plus the sample form handling messages and a FileSystemWatcher and logging this all into two listboxes.

 

[Jay1b]

Thanks, I will take a look at lunch time