3 ms·

When I last tried to implement this, by far the toughest part was making sure the file that’s been newly detected is done being written to. On ntfs I couldn’t

When I last tried to implement this, by far the toughest part was making sure the file that’s been newly detected is done being written to. On ntfs I couldn’t find a good technique, even last modified time was not reliable. I had to watch it for changes myself.

nomel 4y ago
Is "last modified" the time of the beginning of the write?
- bigmattystyles 4y ago
  Never even thought of that; I don’t know. I assumed it was when a write was done. Whatever that means, I don’t know either.
  - 0xJRS 4y ago
    Would this mean that fs event based antivirus scanners could be side-stepped by writing a payload to a file and then never closing the handler?
    - hackarama 4y ago
      Good point here, I will definitely check this and report back. :)
infogulch 4y ago
I've done this by watching the NTFS journal which is surprisingly efficient. First I scanned the whole journal for filesystem metadata and dumped it into a SQLite database (which took about a minute), then kept it up to date which took virtually no resources. This was an absurdly faster way to search by file name, a search across the whole FS came back in milliseconds instead of Explorer's multiple minutes.