Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
5.2.2 FileSystemWatcher
The ‘FileSystemWatcher’ class is part of the ‘System.IO’ namespace provided by
.NET versions 1.1 though to the current 3.5. According to MSDN it listens to the file
system change notifications and raises events when a directory, or file in a directory,
changes. In Figure 21 The FileSystemWatcher is set to watch all files that are
contained in the ‘C:\Test\’ directory. Multiple instances of FileSystemWatcher can
also be run to monitor other directories, that way multiple directories can monitored
using a single application.
// Create a new FileSystemWatcher and set its properties.
FileSystemWatcher watcher = new FileSystemWatcher();
//
Specify the path to watch.
watcher.Path = "c:\\Test\\";
watcher.NotifyFilter = NotifyFilters.LastAccess
|
NotifyFilters.LastWrite
| NotifyFilters.FileName | NotifyFilters.DirectoryName;
//
Specify the file and/or extension to watch.
watcher.Filter = "*.*";
ries = true;
watcher.IncludeSubdirecto
// Add event handlers.
watcher.Changed += new FileSystemEventHandler(OnChanged);
watcher.Created += new FileSystemEventHandler(OnChanged);
watcher.Deleted += new FileSystemEventHandler(OnChanged);
watcher.Renamed += new RenamedEventHandler(OnRenamed);
// Specify the buffer size, default is 8192 (8K).
watcher.InternalBufferSize = 102400;
// Begin Watching.
watcher.EnableRaisingEvents = true;
Figure 21: The FileSystemWatcher class
5.2.3 Capturing Events
When a ‘Renamed’ event occurs it is passed to the above ‘OnRenamed’ class, this
then wraps the various elements of the event in XML tags, this creates an ‘Event
Message’ and includes such things as the clients time and date, the user and details
about the event and the file that was renamed. This is a similar process when a file is
changed. After this stage the Event Message is passed though to the HMAC section,
where a hash signature value will be generated for it. Figure 22 shows this.
42