💻 Directory-Sniffer:

Monitoring folders or entire partitions is a useful way to know what programs are doing on your hard drive.

This program allows you to track and analyze the activities of your programs. You can monitor individual folders or entire partitions. Monitoring can also be set up specifically if only conditional information is required.

When installing large programs, the setup creates many files in the system. In order to find these files, the sniffer can monitor the setup.

🔧 Tools

• Disk Properties
• Disk Information

⚙️ Functions

Categories	Description
Add File	Used to find out which files your program or setup has created.
Remove File	Monitor which files your program has removed.
Renamed File	Find out which files your program has renamed. A report will be provided, converting the original file into the renamed file.
Renamed Directory	Find out which folders your program has renamed. A report will be provided showing the original folders and the renamed folders.
Modification File	Programs also modify the contents of a file as soon as they have access rights. The path to the file whose contents were modified is provided here.
Last Access	To find out when a file was last accessed, the time, date and path are provided here.
Last Write File	To find out when the contents of a file were last changed, the time, date and path are provided here.
Creation Time File	When files are created, the file management system signs the time and date of creation. This information is provided here.

File monitoring involves tracking changes to files or directories on a system. This can be used to monitor file activity, detect unauthorized modifications, or track file creation, deletion, and modification times. Here's a breakdown of key aspects:

1. Purpose: Security: Detecting unauthorized access, modification, or deletion of sensitive files. Integrity: Ensuring that critical application files haven't been tampered with. Backup Verification: Checking for the existence and age of backup files. Performance Monitoring: Tracking the size and modification frequency of log files or other application-related files. Compliance: Meeting regulatory requirements for data access and modification logs.

2. Methods: File System Events: Operating systems provide mechanisms (e.g., inotify on Linux, File System Watcher on Windows) to notify applications when file changes occur. Polling: Periodically checking file attributes (e.g., modification time, size). Specialized Tools: Tools like Checkmk, PRTG, and ManageEngine Applications Manager offer specific file monitoring features.

3. What to Monitor: File Changes: Tracking additions, deletions, and modifications. File Size: Detecting unusually large or small files. File Age: Identifying files that haven't been modified recently or that are older than a specified threshold. File Content: Analyzing file content for specific patterns or keywords. File Permissions: Monitoring changes to file access permissions.

4. Examples: Monitoring log files: Ensuring they are regularly rotated and not excessively large. Tracking configuration file changes: Notifying administrators of unauthorized modifications. Verifying the presence of backup files: Alerting if backups haven't been created as scheduled. Monitoring for unauthorized file uploads: Detecting potentially malicious files being added to a system.

Basic Batch Monitoring (Looping)

@ECHO OFF
SETLOCAL ENABLEDELAYEDEXPANSION

SET "MONITOR_DIR=C:\Path\To\Monitor"
SET "PROCESSED_DIR=C:\Path\To\Processed"

:LOOP
    REM Check for new files
    FOR %%F IN ("%MONITOR_DIR%\*.txt") DO (
        ECHO Found new file: %%F
        REM --- Your processing command here ---
        REM Example: Copy to a processed folder
        MOVE "%%F" "%PROCESSED_DIR%"
        REM --- End of processing ---
    )
    REM Wait for 5 seconds before checking again
    TIMEOUT /T 5 /NOBREAK >NUL
GOTO LOOP

Batch Concepts for Monitoring

• @ECHO OFF : Hides command output for cleaner logs.
• SETLOCAL ENABLEDELAYEDEXPANSION : Allows variables like !count! to update within loops.
• FOR %%F IN (C:\Path\*.*) DO (...) : Iterates through files matching the pattern.
• TIMEOUT /T <seconds> : Pauses execution for a set time.
• ERRORLEVEL : Check ERRORLEVEL (0 for success, 1+ for errors) after commands to see if they worked.
• MOVE / COPY : Actions to take on processed files.

Basic cpp Monitoring

Directory monitoring in C++ is platform-specific, as the standard library (even std::filesystem in C++17/20) does not provide native event-based directory watching. For 2026, the recommended approaches are using OS-specific APIs or modern cross-platform libraries.

• Windows: ReadDirectoryChangesW* The primary way to monitor a directory on Windows is through the Win32 ReadDirectoryChangesW API. It provides detailed notifications for file creation, deletion, renaming, and modification.

#include <windows.h>
#include <iostream>

void WatchDirectory(LPCWSTR path) {
    HANDLE hDir = CreateFileW(path, FILE_LIST_DIRECTORY, 
        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, 
        NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL);

    BYTE buffer[1024];
    DWORD bytesReturned;
    while (ReadDirectoryChangesW(hDir, buffer, sizeof(buffer), TRUE, 
           FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_LAST_WRITE, 
           &bytesReturned, NULL, NULL)) {
        FILE_NOTIFY_INFORMATION* pNotify = (FILE_NOTIFY_INFORMATION*)buffer;
        std::wcout << L"Change detected in: " << pNotify->FileName << std::endl;
        // Handle next entry in buffer if multiple changes occur
    }
}

Basic cpp Monitoring Linux

On Linux, the inotify API is the standard for monitoring file system events. Note that inotify is not recursive by default; you must add a watch for every subdirectory manually if needed.

#include <sys/inotify.h>
#include <unistd.h>
#include <iostream>

void MonitorLinux(const char* path) {
    int fd = inotify_init();
    int wd = inotify_add_watch(fd, path, IN_MODIFY | IN_CREATE | IN_DELETE);
    
    char buffer[4096];
    while (true) {
        int length = read(fd, buffer, sizeof(buffer));
        struct inotify_event* event = (struct inotify_event*)buffer;
        if (event->mask & IN_CREATE) std::cout << "Created: " << event->name << std::endl;
        // ... handle other events
    }
}