EaseFilter File Access Monitor SDK

EaseFilter File Access Monitor SDK is a file system filter driver, it allows you to develop file audit and file monitor Windows application, to monitor the file change and file access in real time, intercept the file I/O requests. You can capture the file open, file creation, file change, file read, file written, query file information, set file information, query security information, set security information, file rename, file delete, directory browsing and file close I/O requests. You can create the file access log, you will know who, when, what files were accessed. You can get comprehensive control and visibility over users and data by tracking and monitoring all the user & file activities, permission changes, storage capacity and generate real-time audit reports.

EaseFilter File Access Monitor SDK is a file system filter driver, a kernel-mode component that runs as part of the Windows executive above the file system. The EaseFilter file system filter driver can intercept requests targeted at a file system or another file system filter driver. By intercepting the request before it reaches its intended target, the filter driver can extend or replace functionality provided by the original target of the request. The EaseFilter file system filter driver can log, observe, modify, or even prevent the I/O operations for one or more file systems or file system volumes.

You can develop the software with File Access Monitor SDK for the following purposes:

• Create your own Continuous data protection (CDP) software to log the file update information, write information with offset and length in real time.
• Audit your file content. You can intercept any file system call, analyze it content, log it.
• Create Access Log, you will know who, when, what files were accessed.
• Journal the file update information. This control may be based on any file parameters, such as its location, type, size, etc.

With the EaseFilter File Monitor SDK, you can get the notification when the managed files were changed with below events:

• File Creation Event: You can get the notification when a new file was created.
• File Delete Event: you can get the notification when a file was deleted.
• File Rename Event: You can get the notification when a file was renamed.
• File Write Event: You can get the notification when a file was written with data.
• File Security Changed Event: You can get the notification when a file’s security was changed.
• File Information Changed Event: You can get the notification when a file’s size, a file’s attributes, a file’s last write time, a file’s creation time, a file’s last access time were changed.

To monitor the file I/O, you can setup multiple file filter rules. In the file filter rule, you can setup what processes or users can monitor the file I/O, you can setup the file filter mask which you can only monitor the specific file’s I/O, you can filter the file I/O with the file open options, you can register the file change events or register the specific file I/Os.