Few days ago I visited NoVirusThanks, a security website that is well known for its free multi-engine antivirus scanner that allows you to upload suspicious files and have it scanned with 14 different antivirus engines. It used to support more than 20 different antivirus brands but now only left with 14 which I’m not sure why. At their products page I noticed that they posted a very interesting tool called Deletion Extension Monitor (DEM) which is designed to monitor and log files deleted in the system.
When Deletion Extension Monitor was newly released, there was no trial version but I was very eager to try it out so I bought a license. I got the activation code instantly after payment but unfortunately the code didn’t work and kept on reporting that the code has already been activated. I emailed the support team and within 24 hours I got a new activation key to activate the software. When I managed to activate DEM and ran it, I encountered a second bug which the filename column shows only Z: path and nothing else. Again I contacted them and they provided an update to DEM which fixes the problem. After a couple of months, Deletion Extension Monitor has gone through a few revisions and has fixed numerous bugs plus adding a few nice features.
Deletion Extension Monitor has a very simple graphical user interface that shows only the necessary information such as date and time, the process that that deleted the files, the full path with filename of the file that was deleted, file extension and also the size of the file. By default it monitors a list of well known extensions and you can easily set it to monitor all file extensions by clicking the Monitoring from the menu bar, select File Extensions and check the “Monitor All File Extensions” option. Instead of monitoring system wide for file deletion, you can set the folder to monitor using the command line option, for example, the command line below would only monitor C:\raymond, C:\paul and C:\juan.
dem.exe -C:\raymond*C:\paul*C:\juan
If you click on the Settings from the menubar and select Configure, you get to enable a really cool and advanced feature where Deletion Extension Monitor can copy low-level files which are normally drivers. It can also run in stealth mode where the program is hidden from the tray icon but do take note that the DEM.exe process is still visible in Windows Task Manager. Simply move the mouse cursor to the Stealth Mode box, left click on it and press any combination of keys to set set it as the hotkey to enable or disable the Stealth Mode.
As useful as Deletion Extension Monitor is, probably only a handful of users would need to use such tool because normal users don’t really need to constantly monitor what files are being secretly deleted from their computer. Some example usage of Deletion Extension Monitor is to monitor files deleted during the uninstallation of a specific setup file, or even to see if there is a hidden virus, malware or trojan that has been secretly deleting your files without your knowledge.
There are many tools that logs changes to monitored folders but very specializes in only monitoring deleted files based on file extensions. Another utility that can do what DEM does is Process Monitor. You will need to get the filters right which can be too confusing and powerful to not so advanced users. As previously said, Deletion Extension Monitor used to be a shareware that cost $9.99 for 1 PC license valid for lifetime but somewhere along the way it has turned into a freeware. Deletion Extension Monitor is compatible with Windows 2000 to Windows 7 but only for 32bit.
Download Deletion Extension Monitor
Related posts: