CMD.exe: Check when A File is Opened

Dalgetty · 11-01-2009, 02:14 PM

Hi Folks,

I would be very grateful if anyone could supply the relevent lines of code as they are beyond me. I want to know the date and time someone has opened a data file. The data file might be on a floppy/ memory stick

Thank you

Dalgetty

**TheOutcaste** · 11-03-2009, 02:29 AM

Code:

Dir  /TA [path\]filename.ext

/T controls the Time Field that is displayed, A is for Last Access
See Dir /?

Dalgetty · 11-04-2009, 07:01 AM

Many thanks,

Learn something every day - I didn't know that. However, what I should have added but it got lost off my cut and paste was that I wanted to be able to identify access in real time so that I could flash up a warning message.

Apologies

Dalgetty

**TheOutcaste** · 11-04-2009, 04:19 PM

That can be done using the VBScript below, but some gotchas in Windows.

Vista/Win 7 by default does not update the Last Accessed time when a file is opened.
Check this key in the registry:

Code:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem

Find the value on the right named NtfsDisableLastAccessUpdate It will have a value of 1. Change this to 0, or delete the value.
You have to reboot for this to take affect.
This is not the default in XP, but may have been set as a Performance Tweak, so best to check for that value in NT/2K/XP as well.

Windows does not immediately update the Last Accessed time. It can take up to an hour before Windows updates the time after you open a file. It does get updated immediately if you modify then save the file.

Files can be shown as being accessed even if they aren't specifically opened. I had one file open in Notepad to see when it would be flagged as being accessed. I had Windows Explorer open on a different folder.
40 minutes later, it listed every file in the folder as being accessed multiple times over the next 5 minutes. I have no idea what was accessing the files, no AV or Malware scans were scheduled. I wasn't even using the PC at the time, as I was on the phone.

When you first start monitoring a folder, every file in it may get accessed. When I changed the folder that was being monitored and started the script in a new Command Prompt, it listed every file in the folder as being accessed. Starting it again, even after closing the Command Prompt window I had run it from did not list the files again however.

I've found that opening a file by using Open With | Choose Program will sometimes show the file as being accessed immediately. Seems to work when opening .vbs files with Notepad. Doesn't work opening .txt files with Wordpad.
Just using Open With and selecting the program doesn't seem to work, you have to use the Choose Program dialog.

You can give this a try to see how it works in your situation, but doesn't seem it will be very Real Time.
Edit the path to the folder in the first line, then save this as watch.vbs
Run it by opening a command prompt, navigate to the folder that you saved the watch.vbs file into (or specify the full path) and type this:
cscript watch.vbs

To Exit, press CTRL+C
You can just double click the file, and it will pop up a message box for each change event, but to exit, you'll have to end task on these three files from Task Manager:
wscript.exe
wmiapsvr.exe
wmiprvse.exe

Code:

strPath = "c:\Test dir"
strComputer = "."
strDrive = split(strPath,"\")(0)
strFolder = split(strPath,":")(1)
strFolder = Replace(strFolder, "\", "\\") & "\\"
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
    ("SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE " _
        & "TargetInstance ISA 'CIM_DataFile' AND " _
         & "TargetInstance.Drive='" & strDrive & "' AND " _
          & "TargetInstance.Path='" & strFolder & "'")

Wscript.Echo vbCrlf & Now & vbTab & "Monitoring " & strPath & " for a Change Event" & vbCrlf

Do
  Set objLatestEvent = colMonitoredEvents.NextEvent
  Select Case objLatestEvent.Path_.Class

  Case "__InstanceModificationEvent"
    If objLatestEvent.TargetInstance.LastModified <> objLatestEvent.PreviousInstance.LastModified then
      WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName & " was modified" & vbCrlf
    End If

    If objLatestEvent.TargetInstance.LastAccessed <> objLatestEvent.PreviousInstance.LastAccessed then
      WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName & " was accessed" & vbCrlf
    End If

  End Select
Loop

You can easily add monitoring for files created/deleted, or have it open a message box instead of echoing a line to the Command Prompt.

**TheOutcaste** · 11-04-2009, 04:58 PM

Update:
On the 2nd folder I was monitoring, after about 30 minutes is listed every file except the one I had open in Notepad as being accessed. The one open in Notepad was shown as being accessed exactly one hour after I opened it and saved a change.

11-01-2009, 02:14 PM	#1 (permalink)
Dalgetty Registered User Join Date: Oct 2009 Posts: 7 OS: Windows 2000 Pro Sp4	CMD.exe: Check when A File is Opened Hi Folks, I would be very grateful if anyone could supply the relevent lines of code as they are beyond me. I want to know the date and time someone has opened a data file. The data file might be on a floppy/ memory stick Thank you Dalgetty

11-03-2009, 02:29 AM	#2 (permalink)
TheOutcaste TSF Enthusiast Join Date: Mar 2009 Location: Portland, OR Posts: 815 OS: MS-Dos 6.22 - Win7	Re: CMD.exe: Check when A File is Opened Code: Dir /TA [path\]filename.ext /T controls the Time Field that is displayed, A is for Last Access See Dir /? __________________ Microsoft MVP - Windows Desktop Experience Of course I know all the answers; I just don't always match the answers to the right questions. Rated R for Violence -- When your PC flies through a window, that's violent, right?

11-04-2009, 07:01 AM	#3 (permalink)
Dalgetty Registered User Join Date: Oct 2009 Posts: 7 OS: Windows 2000 Pro Sp4	Re: CMD.exe: Check when A File is Opened Many thanks, Learn something every day - I didn't know that. However, what I should have added but it got lost off my cut and paste was that I wanted to be able to identify access in real time so that I could flash up a warning message. Apologies Dalgetty

11-04-2009, 04:19 PM	#4 (permalink)
TheOutcaste TSF Enthusiast Join Date: Mar 2009 Location: Portland, OR Posts: 815 OS: MS-Dos 6.22 - Win7	Re: CMD.exe: Check when A File is Opened That can be done using the VBScript below, but some gotchas in Windows. Vista/Win 7 by default does not update the Last Accessed time when a file is opened. Check this key in the registry: Code: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem Find the value on the right named NtfsDisableLastAccessUpdate It will have a value of 1. Change this to 0, or delete the value. You have to reboot for this to take affect. This is not the default in XP, but may have been set as a Performance Tweak, so best to check for that value in NT/2K/XP as well. Windows does not immediately update the Last Accessed time. It can take up to an hour before Windows updates the time after you open a file. It does get updated immediately if you modify then save the file. Files can be shown as being accessed even if they aren't specifically opened. I had one file open in Notepad to see when it would be flagged as being accessed. I had Windows Explorer open on a different folder. 40 minutes later, it listed every file in the folder as being accessed multiple times over the next 5 minutes. I have no idea what was accessing the files, no AV or Malware scans were scheduled. I wasn't even using the PC at the time, as I was on the phone. When you first start monitoring a folder, every file in it may get accessed. When I changed the folder that was being monitored and started the script in a new Command Prompt, it listed every file in the folder as being accessed. Starting it again, even after closing the Command Prompt window I had run it from did not list the files again however. I've found that opening a file by using Open With \| Choose Program will sometimes show the file as being accessed immediately. Seems to work when opening .vbs files with Notepad. Doesn't work opening .txt files with Wordpad. Just using Open With and selecting the program doesn't seem to work, you have to use the Choose Program dialog. You can give this a try to see how it works in your situation, but doesn't seem it will be very Real Time. Edit the path to the folder in the first line, then save this as watch.vbs Run it by opening a command prompt, navigate to the folder that you saved the watch.vbs file into (or specify the full path) and type this: cscript watch.vbs To Exit, press CTRL+C You can just double click the file, and it will pop up a message box for each change event, but to exit, you'll have to end task on these three files from Task Manager: wscript.exe wmiapsvr.exe wmiprvse.exe Code: strPath = "c:\Test dir" strComputer = "." strDrive = split(strPath,"\")(0) strFolder = split(strPath,":")(1) strFolder = Replace(strFolder, "\", "\\") & "\\" Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") Set colMonitoredEvents = objWMIService.ExecNotificationQuery _ ("SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE " _ & "TargetInstance ISA 'CIM_DataFile' AND " _ & "TargetInstance.Drive='" & strDrive & "' AND " _ & "TargetInstance.Path='" & strFolder & "'") Wscript.Echo vbCrlf & Now & vbTab & "Monitoring " & strPath & " for a Change Event" & vbCrlf Do Set objLatestEvent = colMonitoredEvents.NextEvent Select Case objLatestEvent.Path_.Class Case "__InstanceModificationEvent" If objLatestEvent.TargetInstance.LastModified <> objLatestEvent.PreviousInstance.LastModified then WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName & " was modified" & vbCrlf End If If objLatestEvent.TargetInstance.LastAccessed <> objLatestEvent.PreviousInstance.LastAccessed then WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName & " was accessed" & vbCrlf End If End Select Loop You can easily add monitoring for files created/deleted, or have it open a message box instead of echoing a line to the Command Prompt. __________________ Microsoft MVP - Windows Desktop Experience Of course I know all the answers; I just don't always match the answers to the right questions. Rated R for Violence -- When your PC flies through a window, that's violent, right?

11-04-2009, 04:58 PM	#5 (permalink)
TheOutcaste TSF Enthusiast Join Date: Mar 2009 Location: Portland, OR Posts: 815 OS: MS-Dos 6.22 - Win7	Re: CMD.exe: Check when A File is Opened Update: On the 2nd folder I was monitoring, after about 30 minutes is listed every file except the one I had open in Notepad as being accessed. The one open in Notepad was shown as being accessed exactly one hour after I opened it and saved a change. __________________ Microsoft MVP - Windows Desktop Experience Of course I know all the answers; I just don't always match the answers to the right questions. Rated R for Violence -- When your PC flies through a window, that's violent, right?