C# 记录电脑操作记录

Question

大家好，目前需要实现一个记录电脑操作的功能，当软件运行后，自动将对电脑的所有操作记录到txt到，比如删除文件、创建文件、移动文件等等，hook只能实现鼠标动到哪里，按了什么键，比较麻烦，C# FileSystemWatcher也是指定文件夹进行检测，无法对所有文件夹进行监测。大家有什么好想法没？

Answer 1

 private System.IO.FileSystemWatcher watcher = null;
 
 //Button1的点击事件处理
 private void Button1_Click(object sender, System.EventArgs e)
 {
     if (watcher != null) return;
 
     watcher = new System.IO.FileSystemWatcher();
     //指定监测的路径
     watcher.Path = @"C:\My Documents";
     //监测最终存取时间，最终更新时间，文件和文件夹名的变更
     watcher.NotifyFilter =
         (System.IO.NotifyFilters.LastAccess 
         | System.IO.NotifyFilters.LastWrite
         | System.IO.NotifyFilters.FileName 
         | System.IO.NotifyFilters.DirectoryName);
     //监测所有的文件
     watcher.Filter = "";
     //配置UI的线程
     //没有必要使用控制台应用程序
     watcher.SynchronizingObject = this;
 
     //事件处理的追加
     watcher.Changed += new System.IO.FileSystemEventHandler(watcher_Changed);
     watcher.Created += new System.IO.FileSystemEventHandler(watcher_Changed);
     watcher.Deleted += new System.IO.FileSystemEventHandler(watcher_Changed);
     watcher.Renamed += new System.IO.RenamedEventHandler(watcher_Renamed);
 
     //开始监测
     watcher.EnableRaisingEvents = true;
     Console.WriteLine("开始监测");
 }
 
 //Button2的点击事件处理
 private void Button2_Click(object sender, System.EventArgs e)
 {
     //结束监测
     watcher.EnableRaisingEvents = false;
     watcher.Dispose();
     watcher = null;
     Console.WriteLine("结束监测");
 }
 
 //事件处理
 private void watcher_Changed(System.Object source,
     System.IO.FileSystemEventArgs e)
 {
     switch (e.ChangeType)
     {
         case System.IO.WatcherChangeTypes.Changed:
             Console.WriteLine(
                 "文件「" + e.FullPath + "」被改变了。");
             break;
         case System.IO.WatcherChangeTypes.Created:
             Console.WriteLine(
                 "文件「" + e.FullPath + "」被做成了。");
             break;
         case System.IO.WatcherChangeTypes.Deleted:
             Console.WriteLine(
                 "文件「" + e.FullPath + "」被删除了。");
             break;
     }
 }
 
 private void watcher_Renamed(System.Object source, 
     System.IO.RenamedEventArgs e)
 {
     Console.WriteLine(
         "文件 「" + e.FullPath + "」的名字被改变了。");
 }

Answer 2

7楼好像只能定位到某个文件夹有文件被创建删除等，却不能获得发生变化的文件的名字吧？
e.FullPath 只是路径

Answer 3

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.IO;
using System.Threading;
using System.Management;namespace FileWatch
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }
        private delegate void UpdateWatchTextDelegate(string newText);        public void UpdateWatchText(string newText)
        {
            lstMsg.Items.Add(newText);
        }        public List<Thread> lstThread;        private void Form1_Load(object sender, EventArgs e)
        {
            lstThread = new List<Thread>();
        }
        private void btnStart_Click(object sender, EventArgs e)
        {
            if (btnStart.Tag.ToString() == "0")
            {
                btnStart.Tag = "1";
                btnStart.Text = "停止监控";                string[] drives = System.IO.Directory.GetLogicalDrives();
                for (int i = 0; i < drives.Length; i++)
                {
                    if (Directory.Exists(drives[i]))
                    {
                        System.Threading.Thread thread = new System.Threading.Thread(new ParameterizedThreadStart(watchThread));
                        lstThread.Add(thread);
                        thread.Start(drives[i]);
                    }
                }
            }
            else
            {
                btnStart.Tag = "0";
                btnStart.Text = "开始监控";                for (int i = 0; i < lstThread.Count; i++)
                {
                    try
                    {
                        Thread thd = lstThread[i];
                        thd.Abort();
                    }
                    catch
                    {                    }
                }            }        }        public void watchThread(object obj)
        {            FileSystemWatcher watcher = new FileSystemWatcher();            watcher.Path = obj.ToString();//监控路径（文件夹）
            watcher.Filter = "*.*";//如果filter为文件名称则表示监控该文件，如果为*.txt则表示要监控指定目录当中的所有.txt文件
            watcher.NotifyFilter = NotifyFilters.LastWrite |
                NotifyFilters.FileName |
                NotifyFilters.Size;
            this.BeginInvoke(new UpdateWatchTextDelegate(UpdateWatchText), "开始监控：" + watcher.Path);
            //begin watching.
            watcher.IncludeSubdirectories = true;
            watcher.InternalBufferSize = 4096;
            watcher.Deleted += new FileSystemEventHandler(watcher_Deleted);
            watcher.Renamed += new RenamedEventHandler(watcher_Renamed);
            watcher.Changed += new FileSystemEventHandler(watcher_Changed);
            watcher.Created += new FileSystemEventHandler(watcher_Created);
            watcher.EnableRaisingEvents = true;        }        private void watcher_Created(object sender, FileSystemEventArgs e)
        {
            //throw new NotImplementedException();            try
            {
                string msg = "";
                if (isRecord(e.FullPath) == false)
                {
                    return;
                }                msg = "创建文件：" + e.FullPath.ToString() + " " + DateTime.Now.ToString("yyyy/MM/dd HH:mm:ss");                this.BeginInvoke(new UpdateWatchTextDelegate(UpdateWatchText), msg);
            }
            catch (IOException)
            {
                this.BeginInvoke(new UpdateWatchTextDelegate(UpdateWatchText), "Error Writing to log");
            }
        }        private void watcher_Changed(object sender, FileSystemEventArgs e)
        {
            //throw new NotImplementedException();
            try
            {
                string msg = "";
                if (isRecord(e.FullPath) == false)
                {
                    return;
                }                if (e.ChangeType == WatcherChangeTypes.Changed)
                {
                    msg = "修改文件：" + e.FullPath.ToString() + " " + DateTime.Now.ToString("yyyy/MM/dd HH:mm:ss");
                    this.BeginInvoke(new UpdateWatchTextDelegate(UpdateWatchText), msg);
                }
            }
            catch (IOException)
            {
                this.BeginInvoke(new UpdateWatchTextDelegate(UpdateWatchText), "Error Writing to log");
            }
        }        private void watcher_Renamed(object sender, RenamedEventArgs e)
        {
            //throw new NotImplementedException();
            try
            {
                string msg = "";
                if (isRecord(e.FullPath) == false)
                {
                    return;
                }
                msg = "重命名文件：" + e.OldFullPath.ToString() + " 改为：" + e.FullPath + " " + DateTime.Now.ToString("yyyy/MM/dd HH:mm:ss");
                this.BeginInvoke(new UpdateWatchTextDelegate(UpdateWatchText), msg);
            }
            catch (IOException)
            {
                this.BeginInvoke(new UpdateWatchTextDelegate(UpdateWatchText), "Error Writing to log");
            }
        }        private void watcher_Deleted(object sender, FileSystemEventArgs e)
        {
            //throw new NotImplementedException();
            try
            {
                string msg = "";
                if (isRecord(e.FullPath) == false)
                {
                    return;
                }
                msg = "删除文件：" + e.FullPath.ToString() + " " + DateTime.Now.ToString("yyyy/MM/dd HH:mm:ss");
                this.BeginInvoke(new UpdateWatchTextDelegate(UpdateWatchText), msg);
            }
            catch (IOException)
            {
                this.BeginInvoke(new UpdateWatchTextDelegate(UpdateWatchText), "Error Writing to log");
            }
        }        /// <summary>
        /// 过滤不必要的文件夹
        /// </summary>
        /// <param name="path"></param>
        /// <returns></returns>
        private bool isRecord(string path)
        {
            if (path.ToLower().IndexOf(System.IO.Directory.CreateDirectory(System.Environment.SystemDirectory).Parent.FullName.ToLower()) > -1)
            {
                return false;
            }
            if (path.ToLower().IndexOf("recycler") > 0)
            {
                return false;
            }
            if (path.ToLower().IndexOf("ntuser.dat") > 0)
            {
                return false;
            }
            return true;
        }    }
}

Answer 4

写的不错
up
用ThreadPool 应该比List<Thread>方式管理线程对象好一些吧