Question

I am writing some C# code and I need to detect if a specific folder on my windows file system has been opened while the application is running. Is there any way to do it? WinAPI maybe?

Answer 1

There are three API things I think you should check out:

FindFirstChangeNotification() http://msdn.microsoft.com/en-us/library/aa364417%28VS.85%29.aspx
That gives you a handle you can wait on and use to find changes to a file in a particular file, directory, or tree of directories. It won’t tell you when a directory is browsed, but it will tell you when a file is saved, renamed, and so on and so forth.

SetWindowsHookEx() http://msdn.microsoft.com/en-us/library/ms644990%28v=VS.85%29.aspx
You can set that up to give you a callback when any number of events occur – in fact I’m pretty positive that you CAN get this callback when a directory is opened, but it will probably be inordinately difficult because you’ll be intercepting messages to explorer’s window. So you’ll be rebooting during debugging.

Windows Shells http://msdn.microsoft.com/en-us/library/bb776778%28v=VS.85%29.aspx
If that wasn’t painful enough, you can try writing a shell program.

If you’re trying to write a rootkit, I suppose you don’t want me to spoil the details for you. If you’re NOT trying to write a rootkit, I suggest you look it up – carefully. There are open source rootkits, and they all basically have to monitor file access this way to hide from the user / OS.