10 Tools to Monitor Files and Folders for Changes in Real Time
With so many programs working in the background performing their own tasks, it can be quite difficult sometimes to know what what is being written, deleted or modified to and from your drives. There always appears to be something making changes somewhere. Some operations you might be fully aware of such as file downloading, video encoding, antivirus scans etc, but there might also be something writing to the drive when you don’t really expect or want it to. Being able to monitor files across the board would work, but isn’t really practical.
As it would be a thankless task trying to keep watch over all this activity yourself, having a piece of software to help you find out what files are being created or modified could be a real time saver. Thankfully, there are tools around to help you out and keep watching these areas for you, here’s a selection of 10 to have a look at. 1. Watch 4 Folder
While performing the task of watching for a number of different actions such as file or folder create, delete, rename or change, Watch 4 Folder can alert you about the change in several different ways. There are also a few other interesting functions such as watching for a file association change, whether the free space has changed and also if a CD/DVD (not USB media) is inserted or ejected.

The developer recommends you may have to experiment a little bit with the event triggers as ticking something like File change and File rename together would create 2 events in the log after a simple rename. Trigger alerts can be an ordinary desktop popup window or a custom alert window that appears above the system tray. The events can be written to an external log file. A batch file, executable or visual basic script can also be executed. Although you can save different settings files to setup different configurations for certain folders, you cannot monitor more than one folder at a time.
Compatible with Windows XP, Vista and 7 32-bit and 64-bit.
2. Directory Monitor
Directory Monitor is a tool that can watch for file and folder changes, modifications, deletions and the creation of new files, and can do this while being able to handle multiple locations at once. There is the ability to watch network shares in addition to local folders. The adding of Include and exclude wildcard patterns is also possible if you want to exclude certain file types from the monitoring process.

To alert you of any change at the configured locations, Directory Monitor will show the event in its main window which is also the log file, popup a system tray alert or optionally run an external program. Although Directory Monitor is listed as freeware, this is actually a bit misleading because some options like running the program as a service and playing a sound on an event trigger aren’t available unless you “Donate” at least $30.
The .NET Framework 3.5 SP1 is required. Compatible with Windows XP, Vista and 7 32-bit / 64-bit and full install or portable versions are available.
3. TheFolderSpy
This program is able to handle the real time monitoring of multiple folders at once and is a very small portable executable of just over 120K. TheFolderSpy can watch for creation, deletion, attribute changes, access date and file size changes. Be aware the download is a RAR file so you will need a third party tool to unarchive it.

TheFolderSpy has a wildcard option to include certain types of file although only 1 can be applied at once. Something that users may find quite useful is a built in send to email option which will mail you every time an event is triggered which is obviously more suited for rare events and not to monitor a whole drive. Any triggered events will show in the main window, optionally a log file, the system tray balloon popup and a file can be executed including an audio file.
Requires .NET Framework 3.5 and compatible with Windows XP, Vista and 7 32-bit and 64-bit.
4. Track Folder Changes
Track Folder Changes is a very simple, small and portable tool to operate and has no options to configure at all. The type of changes to files and folders it can detect is also slightly less than some other programs, but is still able to identify when they are created, modified or deleted.

By default Track Folder Changes will start to monitor the whole C drive which will obviously create a lot of action and is easily changed to a specific folder with the browse button. All actions are then displayed in real time and the complete directory tree to a change will be expanded. Any changes detected to files or folders are color coded; green is newly created, blue is modified and orange is deleted, so if you simply rename a file you will get an orange and a green entry because the old was removed and a new created. You can go to the location or copy the path via the right click.
Works on Windows XP and above.
5. FolderChangesView
No tools list would be complete without one from Nirsoft and this is no different. FolderChangesView is another tiny, simple and portable utility to handle the task and actively monitor files, folders or complete drives in real time, and tells you which files have been modified, created or deleted. It doesn’t offer to give popup windows or allow the running of scripts on a file create or delete trigger, but instead simply shows all the changes in its main window.

When started, a popup window will ask for the base folder to monitor and a check box for monitoring all its subfolders. A browse option would have been nice but the location has to be typed or pasted in. The window will simply list all files that have been modified, created or deleted since monitoring began in a list format and a counter for each file of the 3 possible actions. Other information such as the full path to the file, its extension, and time of first / last event is also displayed. Monitoring can easily be stopped / started using the toolbar buttons.
Compatible with Windows 2000 up to Windows 8 32-bit and 64-bit.
The other remaining 5 file and folder monitoring tools can be found on page 2.

Hi! Yes, awesome review! Any idea of which programs are compatible with Apple? I want to set up a system where different folders in my office server are “assigned” to different colleagues so each of us gets notifications about changes to their assigned files/folders. Are these kinds of collaborative monitoring processes supported by these programs?
Hi! I am trying to track changes in a folder with music files. From time to time there are some changes in the files that are bothering me like date modified, metadata info or even all the bytes in the file are changed. I think it is related to the player. Although i disabled the features that allows the player to update metadata or file information through the internet, these file changes keep happening.
I want to track what program makes those file changes, so can you recommend me some software that tracks not only the changes but the program responsible for those changes?
Thank you!
Thanks for the clear overview. I downloaded the portable version of Directory Monitor, which seems pretty good even with the free feature set.
I have a folder, part of a larger tree backup I made some months ago that reappears time and again for no reason at all.
Could you please help me with the way to find what is copying it again in the same old folder that was backed up from?
Many thanks.
The tools here won’t do what you are looking for, have a look at this:
https://www.raymond.cc/blog/find-out-what-program-is-secretly-accessing-your-hard-disk-drive/
Use one of those methods to watch and see what process is accessing your drive.
Hi, what if I have a network storage server and want to know which PC or IP (Invected by a virus) that create or modified a file or folder in the network drive so I can track it down.
Hi,
Great review and very helpful! I’m looking for package that also tracks copy or move operations and records the destination folder. Does any of these do that?
Thanks.
#10 (File Alert Monitor) on page 2 redirects to transcriptionbuddy webpage.
Perhaps the link could be updated with the one from Download dot com, or removed?
Thanks for the report, I’ve updated the link to show the original page at the internet archive where both installer and portable versions can still be downloaded.
Hi! Thank you for you job. This is great post, and I just wanted to ask if one of this programs has a record which other app or user manually deletes or modifies the targeted file. For example, Norton360, or uninstaller, or something else. Thank you.
Some of the tools can tell you which user account deleted/modified the files but they can’t tell you specific users if several are working under the same account.
Hey there, any chance that one of these are also reporting the user that made the change to the fie/folder? I’m trying to watch over a file server, but I really need to know which user made the change, just knowing that a change was made is only the (unusable) half of the solution :(
Thanks
Sorry, it was actually pretty obvious – TheFolderSpy. I have already installed and setup, it looks very good to me so far, does exactly the job I needed it to do :)
Thanks a lot for this article!
TheFolderSpy might do want you want, it appears to show under which account the change was made, that might be enough.
Sysinternal’s Process Monitor might also be interesting.
We already mention Process Monitor at the bottom of the article, but it just needs too much filtering to make it easy to use.
Thanks RayMan!
I’m trying to GRASP stuff that’s over my paygrade. Do any of these apps (or any others you’re aware of) report WHAT the changes are (re file changes)?
I’m looking for an INI-Mon. Ideally one with a smart UI…
Thinking about running a local Sourcetree or something, to see what happens when (for example) I map a controller to a VST param (struggling to understand the hierarchy of config, projects, keymaps, and templates!)
can i recommend FileMonitor? temasoft.com/products/filemonitor/
Do any of these tools tell us which file made the change (like a Trojan for example)
thanks
I’m not sure any of them do although I can’t be 100% sure. You may need some kind of HIPS software for that.
You can checkout LepideAuditor Suite which exactly meets to your concern. It helps to track every critical changes/access made on file server into real time and alerts instantly by sending customized email notification.
“Watch 4 Folder” has a virus. Nice!
Incorrect, the installer version is ad supported which is not a virus, it’s adware. The portable version is entirely clean of adware.
Watch 4 Folder v2.3 (with bug fixed – W4FInstallFixed.exe) installs Consumer Input adware. New version 2.5 has free / paid version, but I’m reluctant to try due to adware.
I have tested
Febooti Automatic Workshop and
Filesure
both are good
Adam
Thank you for this post. Very very useful for me
thank you very much