EldoS | Feel safer!

Software components for data protection, secure storage and transfer

FileSystemWatcher and ReadDirectoryChangesW vs. CallbackFilter™

Are you using FileSystemWatcher (.NET class) or ReadDirectoryChangesW function of Windows API? If yes, do you know the limitations of the approaches you use? No? Read ahead.

Feature Windows CallbackFilter
File system support NTFS or network drive. No FAT or FAT32 support Any file system including any local or network file system
Permissions required SeBackupPrivilege and read access to the folder being monitored. SeBackupPrivilege permission is usually available for administrator accounts only None. Use of CallbackFilter doesn't require any special permissions and can be done under limited accounts. Installation of CallbackFilter driver requires administrative rights.
Windows security restrictions Followed. You won't get proper notification on files you don't have access to. Bypassed by the driver. Your application gets notifications about all file and directory events and doesn't care about security permissions set on files and directories.
Operation mode Asynchronous (you only get notifications) Synchronous or Asynchronous (you can intercept the request and modify it or prevent it from being processed)
Types of events tracked Creation, Deletion, Modification, Renaming All types of file system events (including access and directory enumeration) are tracked
Reliability Not reliable (some notifications can be omited or lost) Reliable (you get notifications on all events that happen when your application is running)
Source code availability no yes

|

Back to top