Detect file 'COPY' operation in Windows

Question

Say I want to be informed whenever a file copy is launched on my system and get the file name, the destination where it is being copied or moved and the time of copy.

<

Answer 1

Windows has the concept of I/O filters which allow you to intercept all I/O operations and choose to perform additional actions as a result. They are primarily used for A/V type scenarios but can be programmed for a wide variety of tasks. The SysInternals Process Monitor for example uses a I/O filter to see the file level access.

You can view your current filters using MS Filter Manager, (fltmc.exe from a command prompt)

There is a kit to help you write filters, you can get the drivers and develop your own.

http://www.microsoft.com/whdc/driver/filterdrv/default.mspx is a starting place to get in depth info