With so many programs working in the background performing their own tasks, it can be quite difficult sometimes to know what what is being written, deleted or modified to and from your drives. There always appears to be something making changes somewhere. Some operations you might be fully aware of such as file downloading, video encoding, antivirus scans etc, but there might also be something writing to the drive when you don’t really expect or want it to. Being able to monitor files across the board would work, but isn’t really practical.
As it would be a thankless task trying to keep watch over all this activity yourself, having a piece of software to help you find out what files are being created or modified could be a real time saver. Thankfully, there are tools around to help you out and keep watching these areas for you, here’s a selection of 10 to have a look at.
While performing the task of watching for a number of different actions such as file or folder create, delete, rename or change, Watch 4 Folder can alert you about the change in several different ways. There are also a few other interesting functions such as watching for a file association change, whether the free space has changed and also if a CD/DVD (not USB media) is inserted or ejected.
The developer recommends you may have to experiment a little bit with the event triggers as ticking something like File change and File rename together would create 2 events in the log after a simple rename. Trigger alerts can be an ordinary desktop popup window or a custom alert window that appears above the system tray. The events can be written to an external log file. A batch file, executable or visual basic script can also be executed. Although you can save different settings files to setup different configurations for certain folders, you cannot monitor more than one folder at a time.
Compatible with Windows XP, Vista and 7 32-bit and 64-bit.
2. Directory Monitor
Directory Monitor is a tool that can watch for file and folder changes, modifications, deletions and the creation of new files, and can do this while being able to handle multiple locations at once. There is the ability to watch network shares in addition to local folders. The adding of Include and exclude wildcard patterns is also possible if you want to exclude certain file types from the monitoring process.
To alert you of any change at the configured locations, Directory Monitor will show the event in its main window which is also the log file, popup a system tray alert or optionally run an external program. Although Directory Monitor is listed as freeware, this is actually a bit misleading because some options like running the program as a service and playing a sound on an event trigger aren’t available unless you “Donate” at least $30.
The .NET Framework 3.5 SP1 is required. Compatible with Windows XP, Vista and 7 32-bit / 64-bit and full install or portable versions are available.
This program is able to handle the real time monitoring of multiple folders at once and is a very small portable executable of just over 120K. TheFolderSpy can watch for creation, deletion, attribute changes, access date and file size changes. Be aware the download is a RAR file so you will need a third party tool to unarchive it.
TheFolderSpy has a wildcard option to include certain types of file although only 1 can be applied at once. Something that users may find quite useful is a built in send to email option which will mail you every time an event is triggered which is obviously more suited for rare events and not to monitor a whole drive. Any triggered events will show in the main window, optionally a log file, the system tray balloon popup and a file can be executed including an audio file.
Requires .NET Framework 3.5 and compatible with Windows XP, Vista and 7 32-bit and 64-bit.
4. Track Folder Changes
Track Folder Changes is a very simple, small and portable tool to operate and has no options to configure at all. The type of changes to files and folders it can detect is also slightly less than some other programs, but is still able to identify when they are created, modified or deleted.
By default Track Folder Changes will start to monitor the whole C drive which will obviously create a lot of action and is easily changed to a specific folder with the browse button. All actions are then displayed in real time and the complete directory tree to a change will be expanded. Any changes detected to files or folders are color coded; green is newly created, blue is modified and orange is deleted, so if you simply rename a file you will get an orange and a green entry because the old was removed and a new created. You can go to the location or copy the path via the right click.
Works on Windows XP and above.
No tools list would be complete without one from Nirsoft and this is no different. FolderChangesView is another tiny, simple and portable utility to handle the task and actively monitor files, folders or complete drives in real time, and tells you which files have been modified, created or deleted. It doesn’t offer to give popup windows or allow the running of scripts on a file create or delete trigger, but instead simply shows all the changes in its main window.
When started, a popup window will ask for the base folder to monitor and a check box for monitoring all its subfolders. A browse option would have been nice but the location has to be typed or pasted in. The window will simply list all files that have been modified, created or deleted since monitoring began in a list format and a counter for each file of the 3 possible actions. Other information such as the full path to the file, its extension, and time of first / last event is also displayed. Monitoring can easily be stopped / started using the toolbar buttons.
Compatible with Windows 2000 up to Windows 8 32-bit and 64-bit.
The other remaining 5 file and folder monitoring tools can be found on page 2.
6. Windows Explorer Tracker
Windows Explorer Tracker monitors a number of file operations in Windows Explorer, displays them in its window and records them in a log file. The program differs slightly from some other monitoring tools because it monitors all drives including network drives, but only records the actions created through Windows Explorer itself for delete, rename, create, insert, add and remove. It will also record when drives and storage media like USB sticks are inserted or removed.
Windows Explorer Tracker works on a continuous logging system so each session you run that day will be appended to the last. You can manage each days logs by clicking on Manage log files and the folders are split into year / month / day. All the relevant event information which goes into the log will be shown in the program’s main window. The program works best if you disable “Hide extensions for known file types” in Explorer so the file names make a bit more sense. Beware of the Install Manager program during setup trying to offer adware.
Compatible with Windows XP, Vista and 7 or higher, 32 and 64-bit.
Spy-The-Spy is actually a bit more of a security tool than a general file and folder change monitor and was developed to watch for spyware installing itself onto a system. The program sits in the system tray and watches a specified number of folders and pops up an alert when a recognized change is detected. The scope of the monitoring is relatively small because it only watches for created, modified or renamed executable’s (.exe) and .dll files.
Once installed you need to right click on the tray icon -> Settings to add or remove the folders to monitor, obviously using just C:\ could produce lots of alerts if you’re constantly installing software etc. Now anytime an EXE or DLL is added, renamed or modified in the monitored folders, a warning window will appear telling you what has cause the alert. The Move to Quarantine and SFC buttons in the window might be useful if you are watching for potentially malicious processes to be created, but unnecessary if the program is being used a simple file monitor.
Tested and works on Windows XP to Windows 7.
8. SpyMe Tools
SpyMe Tools is a bit of a dual role utility because it can also perform before and after snapshots to compare after monitoring software installs etc, and has also been mentioned in the Tracking Registry and Files Changes When Installing Software in Windows article. It does however, also has a real time function to monitor files and can also monitor a selected folder or a whole drive.
When you run SpyMe Tools, look for “Real Time Monitor” in the toolbar and click the small icon to the right to open the configuration window. The program can watch for file and folder actions including create, delete, rename, time stamp changes and optionally disable either file or folder monitoring. Simply select the drive(s) or specified folder, set a wildcard if needed to watch for certain types of file, and then switch to the View tab to start monitoring.
SpyMe Tools is a little on the old side dating back to 2007 but worked fine in Windows 7 and has both portable and setup installer versions available.
9. Disk Pulse
The free version of Disk Pulse has several restrictions compared to the paid versions on offer, such as no file types, rules, categories or filters and some logging functions etc. It is certainly competent enough though to do the basics of monitoring all types of files and folders for changes which are create, modify, rename and delete.
When you start the program and press Monitor, the options to add one or multiple folders, the monitoring options, events and include / exclude folders are available before you press Start to begin monitoring. The main window is split in two with the color coded logging at the top and 5 sets of category statistics at the bottom. A nice feature is the Charts option which gives a nice bar or pie chart of the changes which can be printed out or copied to the clipboard.
Disk Pulse works on Windows 2000 and above, 32-bit or 64-bit versions are selected via the drop down on the download screen.
10. File Alert Monitor
File Alert Monitor is slightly different to the other tools here because it isn’t totally real time and instead actively scans the folders you specify every xx number of seconds for new, modified or removed files. It’s also not really designed to monitor files with continuous operations because every event pops up a small dialog box in the center of your screen with an OK button you have to click on to confirm. Maybe it’s more suited to something like monitoring a shared folder to notify you when a file has been received or deleted etc.
A couple of settings might need to be changed from default such as delete monitor is not enabled, the refresh interval which is set at 60 seconds and file types is only set to monitor WAV files. Set it to All file types or add in some more of your own. To reach the options, when in the folder add / remove window go to View -> Options. File Alert Monitor can also play a sound when an event occurs and log events to a file.
Works on Windows XP and above.
Editor’s Note: Although not included here, a favorite techie’s tool Process Monitor could also be configured to perform these functions in some capacity. The problem with Process Monitor is it creates so much system data and information, actually setting it up to monitor files and folders for create/delete/rename actions is really not that easy and requires extensive use of the filters function.