<p>In Windows, is there an easy way to tell if a folder has a subfile that has changed?</p>

<p>I verified, and the last modified date on the folder does not get updated when a subfile changes.</p>

<p>Is there a registry entry I can set that will modify this behavior?</p>

<p>If it matters, I am using an NTFS volume. </p>

<p>I would ultimately like to have this ability from a C++ program.  </p>

<p><strong>Scanning an entire directory recursively will not work for me because the folder is much too large.</strong></p>

<p><strong>Update: I really need a way to do this without a process running while the change occurs.  So installing a file system watcher is not optimal for me.</strong> </p>

<p><strong>Update2: The archive bit will also not work because it has the same problem as the last modification date.  The file's archive bit will be set, but the folders will not.</strong></p>

[{'answer_id': 56695, 'author': 'Adam Davis', 'author_id': 2915, 'author_profile': 'https://Stackoverflow.com/users/2915', 'pm_score': 1, 'selected': False, 'text': '<p>If you can\'t run a process when the change occurs, then there\'s not much you can do except scan the filesystem, and check the modification date/time.  This requires you to store each file\'s last date/time, though, and compare.</p>\n\n<p>You can speed this up by using the <a href="http://en.wikipedia.org/wiki/Archive_bit" rel="nofollow noreferrer">archive bit</a> (though it may mess up your backup software, so proceed carefully).</p>\n\n<blockquote>\n  <p>An archive bit is a file attribute\n  present in many computer file systems,\n  notably FAT, FAT32, and NTFS. The\n  purpose of an archive bit is to track\n  incremental changes to files for the\n  purpose of backup, also called\n  archiving.</p>\n  \n  <p>As the archive bit is a binary bit, it\n  is either 1 or 0, or in this case more\n  frequently called set (1) and clear\n  (0). The operating system sets the\n  archive bit any time a file is\n  created, moved, renamed, or otherwise\n  modified in any way. The archive bit\n  therefore represents one of two\n  states: "changed" and "not changed"\n  since the last backup.</p>\n  \n  <p>Archive bits are not affected by\n  simply reading a file. When a file is\n  copied, the original file\'s archive\n  bit is unaffected, however the copy\'s\n  archive bit will be set at the time\n  the copy is made.</p>\n</blockquote>\n\n<p>So the process would be:</p>\n\n<ol>\n<li>Clear the archive bit on all the files</li>\n<li>Let the file system change over time</li>\n<li>Scan all the files - any with the archive bit set have changed</li>\n</ol>\n\n<p>This will eliminate the need for your program to keep state, and since you\'re only going over the directory entries (where the bit is stored) and they are clustered, it should be very, very fast.</p>\n\n<p>If you can run a process during the changes, however, then you\'ll want to look at the <a href="http://msdn.microsoft.com/en-us/library/system.io.filesystemwatcher(VS.80).aspx" rel="nofollow noreferrer">FileSystemWatcher</a> class.  Here\'s an <a href="http://msdn.microsoft.com/en-us/library/chzww271(VS.80).aspx" rel="nofollow noreferrer">example</a> of how you might use it.</p>\n\n<p>It also exists in <a href="https://web.archive.org/web/1/http://articles.techrepublic%2ecom%2ecom/5100-10878_11-6165137.html" rel="nofollow noreferrer">.NET</a> (for future searchers of this type of problem)</p>\n\n<p>Perhaps you can leave a process running on the machine watching for changes and creating a file for you to read later.</p>\n\n<p>-Adam</p>\n'}, {'answer_id': 56699, 'author': 'NotMyself', 'author_id': 303, 'author_profile': 'https://Stackoverflow.com/users/303', 'pm_score': 0, 'selected': False, 'text': '<p>If you are not opposed to using .NET the <a href="http://msdn.microsoft.com/en-us/library/system.io.filesystemwatcher.aspx" rel="nofollow noreferrer">FileSystemWatcher</a> class will handle this for you fairly easily.</p>\n'}, {'answer_id': 56710, 'author': 'Tony Lee', 'author_id': 5819, 'author_profile': 'https://Stackoverflow.com/users/5819', 'pm_score': 0, 'selected': False, 'text': '<p>Nothing easy - if you have a running app you can use the Win32 file change notification apis (FindFirstChangeNotification) as suggested with the other answers.  warning: circa 2000 trend micro real-time virus scanner would group the changes together making it necessary to use really large buffers when requesting the file system change lists.</p>\n\n<p>If you don\'t have a running app, you can turn on ntfs journaling and scan the journal for changes <a href="http://msdn.microsoft.com/en-us/library/aa363798(VS.85).aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/aa363798(VS.85).aspx</a> but this can be slower than scanning the whole directory when the # of changes is larger than the # of files.</p>\n'}, {'answer_id': 56762, 'author': 'Brian R. Bondy', 'author_id': 3153, 'author_profile': 'https://Stackoverflow.com/users/3153', 'pm_score': 0, 'selected': False, 'text': '<p>From the double post someone mentioned: WMI Event Sink</p>\n\n<p>Still looking for a better answer though.</p>\n'}, {'answer_id': 56768, 'author': 'botismarius', 'author_id': 4528, 'author_profile': 'https://Stackoverflow.com/users/4528', 'pm_score': 4, 'selected': True, 'text': '<p>This <a href="http://msdn.microsoft.com/en-us/library/aa365261(VS.85).aspx" rel="nofollow noreferrer">article</a>  should help. Basically, you create one or more notification object such as:</p>\n\n<pre>\nHANDLE dwChangeHandles[2]; \ndwChangeHandles[0] = FindFirstChangeNotification( \n      lpDir,                          // directory to watch \n      FALSE,                          // do not watch subtree \n      FILE_NOTIFY_CHANGE_FILE_NAME);  // watch file name changes \n\n   if (dwChangeHandles[0] == INVALID_HANDLE_VALUE) \n   {\n     printf("\\n ERROR: FindFirstChangeNotification function failed.\\n");\n     ExitProcess(GetLastError()); \n   }\n\n// Watch the subtree for directory creation and deletion.  \n   dwChangeHandles[1] = FindFirstChangeNotification( \n      lpDrive,                       // directory to watch \n      TRUE,                          // watch the subtree \n      FILE_NOTIFY_CHANGE_DIR_NAME);  // watch dir name changes \n\n   if (dwChangeHandles[1] == INVALID_HANDLE_VALUE) \n   {\n     printf("\\n ERROR: FindFirstChangeNotification function failed.\\n");\n     ExitProcess(GetLastError()); \n   }\n</pre>\n\n<p>and then you wait for a notification:</p>\n\n<pre>\n while (TRUE) \n   { \n   // Wait for notification. \n      printf("\\nWaiting for notification...\\n");\n\n      DWORD dwWaitStatus = WaitForMultipleObjects(2, dwChangeHandles, \n         FALSE, INFINITE); \n\n      switch (dwWaitStatus) \n      { \n         case WAIT_OBJECT_0: \n\n         // A file was created, renamed, or deleted in the directory.\n         // Restart the notification. \n             if ( FindNextChangeNotification(dwChangeHandles[0]) == FALSE )\n             {\n               printf("\\n ERROR: FindNextChangeNotification function failed.\\n");\n               ExitProcess(GetLastError()); \n             }\n             break; \n\n         case WAIT_OBJECT_0 + 1: \n\n         // Restart the notification. \n             if (FindNextChangeNotification(dwChangeHandles[1]) == FALSE )\n             {\n               printf("\\n ERROR: FindNextChangeNotification function failed.\\n");\n               ExitProcess(GetLastError()); \n             }\n             break; \n\n         case WAIT_TIMEOUT:\n\n         // A time-out occurred. This would happen if some value other \n         // than INFINITE is used in the Wait call and no changes occur.\n         // In a single-threaded environment, you might not want an\n         // INFINITE wait.\n\n            printf("\\nNo changes in the time-out period.\\n");\n            break;\n\n         default: \n            printf("\\n ERROR: Unhandled dwWaitStatus.\\n");\n            ExitProcess(GetLastError());\n            break;\n      }\n   }\n}\n</pre>\n'}, {'answer_id': 57024, 'author': 'PabloG', 'author_id': 394, 'author_profile': 'https://Stackoverflow.com/users/394', 'pm_score': 1, 'selected': False, 'text': '<p>Perhaps you can use the NTFS 5 Change Journal with DeviceIoControl as explained <a href="http://www.microsoft.com/msj/0999/journal/journal.aspx" rel="nofollow noreferrer">here</a></p>\n'}, {'answer_id': 168823, 'author': 'Serge Wautier', 'author_id': 12379, 'author_profile': 'https://Stackoverflow.com/users/12379', 'pm_score': 2, 'selected': False, 'text': '<p><a href="http://msdn.microsoft.com/en-us/library/aa365465%28VS.85%29.aspx" rel="nofollow noreferrer">ReadDirectoryChangesW</a></p>\n\n<p>Some excellent sample code in <a href="http://www.codeproject.com/KB/files/directorychangewatcher.aspx" rel="nofollow noreferrer">this CodeProject article</a></p>\n'}, {'answer_id': 335259, 'author': 'Jonas Engström', 'author_id': 7634, 'author_profile': 'https://Stackoverflow.com/users/7634', 'pm_score': 2, 'selected': False, 'text': '<p>This is perhaps overkill, but the <a href="http://www.microsoft.com/whdc/devtools/ifskit/default.mspx" rel="nofollow noreferrer">IFS kit</a> from MS or the <a href="http://www.osr.com/toolkits_fddk.shtml" rel="nofollow noreferrer">FDDK</a> from OSR might be an alternative. Create your own filesystem filter driver with simple monitoring of all changes to the filesystem.</p>\n'}]
['https://Stackoverflow.com/questions/56682', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/3153/']