Windows File System Observer

The WindowsFileSystemObserver project is an open-source project providing file system observations (currently only for Windows OS). It observes the following file/folder operations: create, delete, move, and rename files/folders.

Note: "Opening" a file (e.g. a PDF file) is NOT a file operation. Followingly, the file system observer can NOT observe this user action.

This project uses ​JNIWrapper, a commercial product. DFKI has got a developer license; the WindowsFileSystemObserver project is shipped with a free runtime license.

---

Getting the code

Check out the project from this SVN repository:

https://usercontext.opendfki.de/repos/trunk/WindowsFileSystemObserver

---

Starting

You have 3 alternative ways of starting the file system observer:

• Start this batch file: Launch_WindowsFileSystemObserver.bat
• Use this launch configuration (from inside eclipse): WindowsFileSysObservation.launch
• Start this main class as Java application (from inside eclipse): StandaloneWindowsFileSystemObservation

Attention: Make sure, that the UserObservationHub is running to receive file system observations! ;-)

---

Configuring

Wenn first starting the file observer it opens up the config dialog which allows to add the file folders to observe. You can use the [Add] button to add file folders to observe (subfolders are also observed). After having added some file folders the dialog will look like this:

The file system observer provides an MBean interface you can access via the Java console (jconsole):

So, if you close the config dialog once, you can open it up again by using the jconsole and invoke the [configure] method. Alternatively, you can also invoke [addFolderToObserve].

---

Testing

The file system observer creates NOPs of the observed file operations and passes them to the (hopefully running!) UserObservationHub.

Please keep in mind, that ALL file operations are observed and passed. That means: not only the file operations explicitly invoked by the user but also file operations done by the system or by applications are processed. In other words, if you configure to observe the whole hard disk (e.g. C:\) then you will get really A LOT of NOPs. For example, Mozilla Thunderbird creates and modifies really A LOT of files when running!

Test this:

• Create a new text file
• Rename it to NewTestDocument.txt

What happens is, that Windows creates a file named Neu%20Textdokument.txt (german Windows XP). After renaming the file (by you) it seems, that the file system observer recognizes an additional FileSave operation.

Altogether this results in the following three NOPs being sent to the User Observation Hub:

<rdf:RDF
    xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
    xmlns:nop="http://ontologies.opendfki.de/repos/ontologies/userobs/nop#">
  <nop:CreateFile rdf:about="urn:nop:1213964516125_de.dfki.km.filesysobservation.WindowsFileSystemObserver@1b9658e8">
    <nop:operation_file>
      <nop:File rdf:about="file:/C:/Dokumente%20und%20Einstellungen/schwarz/Eigene%20Dateien/Neu%20Textdokument.txt"/>
    </nop:operation_file>
    <nop:timestamp rdf:datatype="http://www.w3.org/2001/XMLSchema#dateTime"
    >2008-06-20T14:21:56.125+02:00</nop:timestamp>
  </nop:CreateFile>
</rdf:RDF>


<rdf:RDF
    xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
    xmlns:nop="http://ontologies.opendfki.de/repos/ontologies/userobs/nop#">
  <nop:RenameFile rdf:about="urn:nop:1213964521890_de.dfki.km.filesysobservation.WindowsFileSystemObserver@1b9658e9">
    <nop:newPath>
      <nop:File rdf:about="file:/C:/Dokumente%20und%20Einstellungen/schwarz/Eigene%20Dateien/NewTestDocument.txt"/>
    </nop:newPath>
    <nop:operation_file>
      <nop:File rdf:about="file:/C:/Dokumente%20und%20Einstellungen/schwarz/Eigene%20Dateien/Neu%20Textdokument.txt"/>
    </nop:operation_file>
    <nop:timestamp rdf:datatype="http://www.w3.org/2001/XMLSchema#dateTime"
    >2008-06-20T14:22:01.890+02:00</nop:timestamp>
  </nop:RenameFile>
</rdf:RDF>


<rdf:RDF
    xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
    xmlns:nop="http://ontologies.opendfki.de/repos/ontologies/userobs/nop#">
  <nop:SaveFile rdf:about="urn:nop:1213964524062_de.dfki.km.filesysobservation.WindowsFileSystemObserver@1b9658e10">
    <nop:operation_file>
      <nop:File rdf:about="file:/C:/Dokumente%20und%20Einstellungen/schwarz/Eigene%20Dateien/NewTestDocument.txt"/>
    </nop:operation_file>
    <nop:timestamp rdf:datatype="http://www.w3.org/2001/XMLSchema#dateTime"
    >2008-06-20T14:22:04.062+02:00</nop:timestamp>
  </nop:SaveFile>
</rdf:RDF>