Hi,
there are several ways to do this but every one is
difficulty and far beyond C# and .NET. C# and
..NET just play the role of eiterh a user interface,
wrapper library or the communication endpoint.
You can use API hooking and monitor for e.g.
CreateFile API Calls and then check which
Process uses that call. But htis is a very difficult
task and not recommended since you can
instabilize your complete OS if your code is
buggy. Another way is to use the FileSystemWatcher
which in core encapsulates the Windows File and
Directory Notification APIs and on a specific file
event you could check who has a handle to that
file by enumerating all system handles and objects
by using NtQuerySystemInformation and some other
undocumented API calls. Some documented can be quite
handy on object security, handle owner etc, but all
calls are undocumented and not easy to use. Another
approcah is to develop a kernel file system driver
with the IFS Kit DDK from Microsoft or Hook
Kernel API calls and/or watch for special events and
or API Function calls. The only way C# can aid you
here is to use a UI that could process IO comming or
going to your kernel driver either by DeviceIoControl
and/or CreateFile/Read-WriteFile/CloseHandle. All
these tasks are difficult and far beyond C# and .NET...
If you really are interrested in a way to do this, then
have a look at this:
[File System Filter Drivers]
http://www.microsoft.com/whdc/driver/filterdrv/default.mspx
But think about it. Do you really have to do this
or is there another way since Kernel Development
is very advanced stuff,...
Regards
Kerem
--
