Search code examples
windowsprofilingntfs

Record and capture NTFS activity

Good day. Say, please, is there any chance to intercept and record NTFS activity? Procmon records system actions on NTFS (create, open, delete, etc.), but does not show the body of blocks that placed on files while saving them.

Thanks!

Solution

  • You will need to write a file system filter driver. Here's a very good tutorial on it:

    File System Filter Driver Tutorial