Sign in to follow this  
Followers 0
IAm777

Getting Events of explorer.exe

7 posts in this topic

#1 ·  Posted (edited)

Hello all, 

Any of you know how to get actions done by an user on explorer.exe . i.e(copy file, rename file etc) 

 

PS: Listening to the entire "file activities" via WMI gets too much data (Hence I only want actions done on explorer.exe) and it also it not possible to find file changes in MTP devices . 

Thanks

Edited by IAm777

Share this post


Link to post
Share on other sites



You'd probably just have to listen to WMI and filter based on what windows explorer has open. Ex: explorer window open to C:, check for anything happening in the root of the drive.

Share this post


Link to post
Share on other sites

You'd probably just have to listen to WMI and filter based on what windows explorer has open. Ex: explorer window open to C:, check for anything happening in the root of the drive.

How about MTP devices ? 

Share this post


Link to post
Share on other sites

>this i think will work for MTP, as it works for ext4 on Linux NAS. mind you it requires SMB to be setup in synchronous mode.

that's my conclusions from some tests i made very long time ago, and with a different version, but based on the same concept. things may be slightly different today.

Share this post


Link to post
Share on other sites

>this i think will work for MTP, as it works for ext4 on Linux NAS. mind you it requires SMB to be setup in synchronous mode.

that's my conclusions from some tests i made very long time ago, and with a different version, but based on the same concept. things may be slightly different today.

 

I dont think MTP is anything like ext4 ,it does not show up as a drive(with drive letters), they show up as "devices" . It needs to monitor the changes being made on the MTP protocol .

for example: If a file is being modified via MTP , the file is downloaded to the device then modified and then reuploaded to the devices.

This is why I thought it will be simpler to monitor manual user actions on explorer.exe . :sweating:  

Share this post


Link to post
Share on other sites

It's kinda looking like you'll need to work with MTP drivers to actually watch the transfers. Unfortunately I can't actually find a good reference though.

Share this post


Link to post
Share on other sites

It's kinda looking like you'll need to work with MTP drivers to actually watch the transfers. Unfortunately I can't actually find a good reference though.

yup , facing the same problem ...

I will post answer when I find it :) 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0