6. Windows Explorer Tracker
Windows Explorer Tracker monitors a number of file operations in Windows Explorer, displays them in its window and records them in a log file. The program differs slightly from some other monitoring tools because it monitors all drives including network drives, but only records the actions created through Windows Explorer itself for delete, rename, create, insert, add and remove. It will also record when drives and storage media like USB sticks are inserted or removed.
Windows Explorer Tracker works on a continuous logging system so each session you run that day will be appended to the last. You can manage each days logs by clicking on Manage log files and the folders are split into year / month / day. All the relevant event information which goes into the log will be shown in the program’s main window. The program works best if you disable “Hide extensions for known file types” in Explorer so the file names make a bit more sense. Beware of the Install Manager program during setup trying to offer adware.
Compatible with Windows XP, Vista and 7 or higher, 32 and 64-bit.
Spy-The-Spy is actually a bit more of a security tool than a general file and folder change monitor and was developed to watch for spyware installing itself onto a system. The program sits in the system tray and watches a specified number of folders and pops up an alert when a recognized change is detected. The scope of the monitoring is relatively small because it only watches for created, modified or renamed executable’s (.exe) and .dll files.
Once installed you need to right click on the tray icon -> Settings to add or remove the folders to monitor, obviously using just C:\ could produce lots of alerts if you’re constantly installing software etc. Now anytime an EXE or DLL is added, renamed or modified in the monitored folders, a warning window will appear telling you what has cause the alert. The Move to Quarantine and SFC buttons in the window might be useful if you are watching for potentially malicious processes to be created, but unnecessary if the program is being used a simple file monitor.
Tested and works on Windows XP to Windows 7.
8. SpyMe Tools
SpyMe Tools is a bit of a dual role utility because it can also perform before and after snapshots to compare after monitoring software installs etc, and has also been mentioned in the Tracking Registry and Files Changes When Installing Software in Windows article. It does however, also has a real time function to monitor files and can also monitor a selected folder or a whole drive.
When you run SpyMe Tools, look for “Real Time Monitor” in the toolbar and click the small icon to the right to open the configuration window. The program can watch for file and folder actions including create, delete, rename, time stamp changes and optionally disable either file or folder monitoring. Simply select the drive(s) or specified folder, set a wildcard if needed to watch for certain types of file, and then switch to the View tab to start monitoring.
SpyMe Tools is a little on the old side dating back to 2007 but worked fine in Windows 7 and has both portable and setup installer versions available.
9. Disk Pulse
The free version of Disk Pulse has several restrictions compared to the paid versions on offer, such as no file types, rules, categories or filters and some logging functions etc. It is certainly competent enough though to do the basics of monitoring all types of files and folders for changes which are create, modify, rename and delete.
When you start the program and press Monitor, the options to add one or multiple folders, the monitoring options, events and include / exclude folders are available before you press Start to begin monitoring. The main window is split in two with the color coded logging at the top and 5 sets of category statistics at the bottom. A nice feature is the Charts option which gives a nice bar or pie chart of the changes which can be printed out or copied to the clipboard.
Disk Pulse works on Windows 2000 and above, 32-bit or 64-bit versions are selected via the drop down on the download screen.
10. File Alert Monitor
File Alert Monitor is slightly different to the other tools here because it isn’t totally real time and instead actively scans the folders you specify every xx number of seconds for new, modified or removed files. It’s also not really designed to monitor files with continuous operations because every event pops up a small dialog box in the center of your screen with an OK button you have to click on to confirm. Maybe it’s more suited to something like monitoring a shared folder to notify you when a file has been received or deleted etc.
A couple of settings might need to be changed from default such as delete monitor is not enabled, the refresh interval which is set at 60 seconds and file types is only set to monitor WAV files. Set it to All file types or add in some more of your own. To reach the options, when in the folder add / remove window go to View -> Options. File Alert Monitor can also play a sound when an event occurs and log events to a file.
Works on Windows XP and above.
Editor’s Note: Although not included here, a favorite techie’s tool Process Monitor could also be configured to perform these functions in some capacity. The problem with Process Monitor is it creates so much system data and information, actually setting it up to monitor files and folders for create/delete/rename actions is really not that easy and requires extensive use of the filters function.