EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Can not get process info for explorer

Posted: 04/14/2015 20:16:03
by Kenny Kim (Basic support level)
Joined: 06/01/2009
Posts: 2

I want to track a Windows Explorer File Copy Operation from the point where the explorer opens the source file to read to the point where it closes the newly created destination file after File Copy Operation was finished. This is needed to decide whether to allow the source file to be copied to a specific drive or not.

Is there any way to store the FileName Parameter of OnReadFileC() Callback in order to retrieve it in OnWriteFileC() Callback? Simply saying, is it possible to attach the file path of source file to all bytes that are being read from the file? That way it would be possible to know where those bytes in the buffer were coming from and to decide whether to continue file write operation or not.

Thank you.
Posted: 04/15/2015 00:36:43
by Eugene Mayevski (Team)

Unfortunately there exists no copy operation in the OS neither you can extend the data being read in any way because the reader has provided a buffer of fixed length.

The only way to attempt to track file copying is store everything that is read by any process, track the files being opened for writing and compare the data being written with the data read and stored before. This way you can conclude that copying takes place.

However, such approach won't work in case when the user packs the data to some (eg. ZIP) archive or burns them to the CD/DVD-RW disk.

Sincerely yours
Eugene Mayevski



Topic viewed 8456 times

Number of guests: 1, registered members: 0, in total hidden: 0


Back to top

As of July 15, 2016 EldoS business operates as a division of /n software, inc. For more information, please read the announcement.

Got it!