Description
A file was there yesterday and is gone today, or its contents changed and nobody knows who did it. Windows can audit that, but only after you open Group Policy, dig through Event Viewer, and accept that the log lags behind. EaseFilter File I/O Monitor sits somewhere else entirely: on a kernel-mode file system filter driver that every file request has to pass through, so what happened is recorded as it happens and no application can route around it.
The interface is one live scrolling table: user name, process name and pid, event, file name, file size, attributes, I/O status, and a final column that says in plain words what occurred — "the new file C:\Test\testFile2.txt was created", "the file will be deleted on close". To watch one folder or one volume instead of everything, you set that scope in the settings.
Every file operation: create, open, read, write, overwrite, rename, delete and close are all recorded, including deferred deletes flagged to happen on close — not just the end state.
Intercepted below the file system: because the recording point is under the file system, it does not matter which API a program picked or whether it went through the standard library; it gets logged either way, which beats hooking in user mode.
Scoped filtering: choose the volumes or folders to watch so a whole-machine trace does not bury the interesting rows under thousands of irrelevant ones.
Records with context: each line is more than "a file changed" — it carries which process and pid did it, when, under which account, what access was requested and whether the call succeeded or failed.
A readable description column: the last column translates the I/O into a sentence, so you are not decoding DesiredAccess and Disposition bit flags by hand.
Ships with SDK source: it is a sample application of the EaseFilter filter driver SDK and the package carries complete C# and C++ demo source, so your own auditing or data-loss-prevention feature can start from it.
The interface is one live scrolling table: user name, process name and pid, event, file name, file size, attributes, I/O status, and a final column that says in plain words what occurred — "the new file C:\Test\testFile2.txt was created", "the file will be deleted on close". To watch one folder or one volume instead of everything, you set that scope in the settings.
Features
Every file operation: create, open, read, write, overwrite, rename, delete and close are all recorded, including deferred deletes flagged to happen on close — not just the end state.
Intercepted below the file system: because the recording point is under the file system, it does not matter which API a program picked or whether it went through the standard library; it gets logged either way, which beats hooking in user mode.
Scoped filtering: choose the volumes or folders to watch so a whole-machine trace does not bury the interesting rows under thousands of irrelevant ones.
Records with context: each line is more than "a file changed" — it carries which process and pid did it, when, under which account, what access was requested and whether the call succeeded or failed.
A readable description column: the last column translates the I/O into a sentence, so you are not decoding DesiredAccess and Disposition bit flags by hand.
Ships with SDK source: it is a sample application of the EaseFilter filter driver SDK and the package carries complete C# and C++ demo source, so your own auditing or data-loss-prevention feature can start from it.
