Introduction

ShareMonitor allows you to monitor any access to your network shared files. When a user remotely opens shared files on your computer, the application detects it and displays information such as who opened it, when it was opened, duration, etc. about that file. All details will be logged and can be saved to .CSV or .XML files for further analysis.
You can also disconnect any active connection whenever you want.

Using the Code

Using “OpenFiles.exe”, it queries opened files in regular periods of time. It continuously compares sequence of OpenFiles.exe outputs and updates the data table. For newly opened files, it inserts related data into a data table. Next time if the file is not still open, it sets it as closed and stores closed time for that file and repeats this routine.

“OpenFiles.exe” was the simplest way possible to find out access to shared resources. Of course there must some Windows API for it and it's better to use them but they seems to be undocumented and I couldn't find anything. Please let me know if you found any related Windows API.

As I tested the program, I noticed that it can't show non-English (Unicode) file names. As this problem refers to output of OpenFiles.exe, I couldn't fix it by code-page manipulating.

Note: OpenFiles.exe is a Windows tool that shows shared files which are currently opened by others. This file is in WINDOWS\system32 folder.

Openfiles.exe output has some information such as connection ID, user who accessed the file, filename, etc. These data are stored in a data table that is created in the code below. There is an extra boolean column named "Closed" which holds the state of the shared file: still in use or closed.

private void PrepareDataTable()
{
    dataTable = new DataTable("ShareMonitor");
    dataTable.Columns.Add("Opened at", typeof(DateTime));
    dataTable.Columns.Add("Closed at", typeof(DateTime));
    dataTable.Columns.Add("Duration", typeof(TimeSpan));

    dataTable.Columns.Add("Host Name");
    dataTable.Columns.Add("ID", typeof(int));
    dataTable.Columns.Add("User Name");
    dataTable.Columns.Add("Type");
    dataTable.Columns.Add("Locks");
    dataTable.Columns.Add("Open Mode");
    dataTable.Columns.Add("File/Folder");

    dataTable.Columns.Add("Closed", typeof(bool));

    dataTable.PrimaryKey = new DataColumn[] { dataTable.Columns["ID"] };
}

RefreshData() is the main method of application which is run periodically by a timer. In this method, I create a new process and execute openfiles.exe with "/query /FO CSV /v" parameters. These parameters mean that I want to get a detailed comma-separated list of shared files which are currently in use.

RedirectStandardOutput property lets you get the process output (which is sent to the console).

Before reading the output (lines), I set all unclosed connections to "closed". This is because they may be closed since the last check and I may not find them in current openfiles output anymore.

Finally, I check the lines string variable. Each line represents one file connection. If connection ID does not exist in the datatable, I insert it as a new open connection. Otherwise, if connection ID exists in datatable, it means that the connection was opened before and is still open. So I set the "Closed" field to false and clear "Closed at" field.

By setting FirstDisplayedScrollingRowIndex property of the grid, you can be assured that newly added connections will be shown in the grid. Something that we call auto scrolling grid rows.

private void RefreshData()
{
    var process = new Process();
    process.StartInfo.FileName = "openfiles.exe";
    process.StartInfo.Arguments = "/query /FO CSV /v";
    process.StartInfo.UseShellExecute = false;
    process.StartInfo.CreateNoWindow = true;
    process.StartInfo.RedirectStandardOutput = true;
    try
    {
        process.Start();
        if ((process.StandardOutput != null))
        {
            var result = process.StandardOutput.ReadToEnd().Trim().Replace("\"", "");
            var lines = result.Split('\n');
            foreach (DataRow row in dataTable.Rows)
            {
                //set all previous open connections to closed because 
                //they may not be still in use!
                var closed = row.Field<bool?>("Closed");
                if (closed == null || closed.Value == false)
                {
                    row["Closed"] = true;
                    row["Closed at"] = DateTime.Now.ToString("G");
                }
                else
                {
                    if (row["Duration"] == DBNull.Value)
                        row["Duration"] = ((DateTime)row["Closed at"]) - 
			((DateTime)row["Opened at"]);
                }
            }

            var firstLineIndex = 1 + lines.Cast<string>().ToList().FindIndex
				(l => l.Contains("Hostname"));
            for (int i = firstLineIndex; i < lines.Count() && firstLineIndex > 0; i++)
            {
                var fields = lines[i].Split(',');
                var row = dataTable.Rows.Find(fields[1]); //ID
                if (row == null) 	//it is a new file and not exists 
				//in datatable... so add it
                {
                    var newRow = dataTable.NewRow();
                    newRow["Opened at"] = DateTime.Now.ToString("yyyy MM dd HH:mm:ss");
                    newRow["Host Name"] = fields[0];
                    newRow["ID"] = fields[1];
                    newRow["User Name"] = fields[2];
                    newRow["Type"] = fields[3];
                    newRow["Locks"] = fields[4];
                    newRow["Open Mode"] = fields[5];
                    newRow["File/Folder"] = fields[6];
                    dataTable.Rows.Add(newRow);

                    //auto scroll
                    var gridRow = grdMain.Rows.Cast<DataGridViewRow>().
                        Where(r => (r.DataBoundItem as DataRowView).Row.Field<int>("ID") 
				== newRow.Field<int>("ID")).
                        SingleOrDefault();
                    if (gridRow != null)
                        grdMain.FirstDisplayedScrollingRowIndex = gridRow.Index;

                }
                else  //it is still in use and not closed
                {
                    row["Closed"] = false;
                    row["Closed at"] = DBNull.Value;
                }
            }

            //auto size columns
            grdMain.AutoResizeColumns(DataGridViewAutoSizeColumnsMode.AllCells);
        }
        process.WaitForExit();
    }
    catch (Exception e)
    {
        lblMsg.Text = " Error: " + e.Message + " : " + DateTime.Now.ToShortTimeString();
    }
    finally
    {
        process.Close();
    }
}

Monitoring Access to Your Shared Files on Network