How to know which process has written to my file

Question

0.00/5 (No votes)

See more:

Hi,
For security reasons I want to know if a file "xyz.txt" has been only modified by MySecureFileWrite.exe( an example ) or some other process.

Is there a way to achieve this task in C?

Posted 14-Aug-12 8:50am

AshakiranBhatter

Add a Solution

Comments

Sergey Alexandrovich Kryukov 14-Aug-12 14:51pm

What do you mean "has written"?
--SA

[no name] 14-Aug-12 14:52pm

I mean either an read/write/update. Wrong key word in the subject again :(

2 solutions

Solution 3

Your process could stamp its encrypted modification time of the file xyz.txt
into an additional trace file xyz.trc , for example :)

Posted 14-Aug-12 9:26am

Eugen Podsypalnikov

Comments

Sergey Alexandrovich Kryukov 14-Aug-12 15:45pm

And..?
--SA

Eugen Podsypalnikov 14-Aug-12 16:16pm

// But if some other process has already written into xyz.txt file,
// how do i know if my xyz.txt file is corrupted or not.
I think, the traced time could answer this question :)

Sergey Alexandrovich Kryukov 14-Aug-12 17:06pm

Any process can fake file time stamps is any way. Not clear why such protection would really be needed.
--SA

Albert Holguin 14-Aug-12 20:24pm

This would probably tell you if someone else has edited the file... wouldn't tell you who (which is what was asked, by reading the title).

Eugen Podsypalnikov 15-Aug-12 3:27am

Yes, that is right :)

Pablo Aliskevicius 15-Aug-12 2:25am

Actually, if you want to protect data in a file, you can (and should) encrypt the whole file to begin with. That's the standard way to protect data.

Eugen Podsypalnikov 15-Aug-12 3:32am

Sure, it is a way :)

Albert Holguin 15-Aug-12 10:13am

Not necessarily, if you want it to still be readable, you only need an encrypted hash in there. License managers do this for license files.

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Sergey Alexandrovich Kryukov · Accepted Answer · 2012-08-14T08:52:00

Solution 1

Please see my comment to the question. What I mean is: if a file is written and already closed, it's too late. You cannot learn which process did it.

[EDIT]

Answering to the follow-up discussion:

In principle, you can protect your file by opening it in your application and keeping the file handle opened during the life time of your application. You need to open a file for exclusive use, which happens by default. If you need to keep the file untouched at all times, you can develop and install a daemon which runs at all times and keeps the file(s) open and hence blocking. Your application(s) should manipulate the content of the file(s) through this daemon only.

This is almost never needed though. You should better review the scenario when such clash could harm, or probably review your architecture.

—SA

Posted 14-Aug-12 8:52am

Sergey Alexandrovich Kryukov

Updated 14-Aug-12 9:28am

v2

Comments

[no name] 14-Aug-12 14:56pm

Only my process knows how to write into xyz.txt file in a best way. But if some other process has already written into xyz.txt file, how do i know if my xyz.txt file is corrupted or not. Just trying to figure out the best way to know to protect a file even from reading or writing from other processes

Sergey Alexandrovich Kryukov 14-Aug-12 15:24pm

If depends on your data model, file structure, etc. And this is not what you asked about. Why do you think you need to protect your file?
--SA

Sergey Alexandrovich Kryukov 14-Aug-12 15:29pm

Anyway, please see my update, after [EDIT].
--SA

[no name] 14-Aug-12 15:32pm

All I was trying to figure out was how to write a FileSystem on my own with the best protection mode I can give it with out actually creating a copy of the filesystem each time I write into it. This way if some other process tries to write into my filesystem and corrupt the data I dont have to restore the copy back to its original. But I don't want to do this either. Why not I prevent the other processes even accessing it? Just trying to figure out this!!!!

nv3 14-Aug-12 15:53pm

Your thought are actually going along the right lines -- sometimes. But I believe that you are not making good use of your time as you are trying to re-invent data processing from the ground up. Many of the posts you have written over the last days show that you have not gained some of the most fundamental basics and you are trying to gain knowledge by undertaking singular experiments and asking questions. You could however proceed much faster on your way by mastering things one after the other and read a couple of books. Learn a programming language, learn the basics of an operating system, learn about databases, learn about GUI environments ... just one step at a time. Remain as hungry for new knowledge as you are and at the same time try to organize your learning experience more effectively.

Just a well meant advice.

What are trying to ask in this question will not get you much further. For one, even if you knew which other process had altered your file, you could not undo the change. So either protect your file by the operating system's security measure against undesired tempering and/or write some code that checks the consistency of your file, each time your process opens it.

Sergey Alexandrovich Kryukov 14-Aug-12 15:57pm

Maybe this is a right idea on what's going on. And the idea on how to approach it is correct; I agree. I would up-voted if it was an answer.
--SA

[no name] 14-Aug-12 16:02pm

Really the best advice I could get. Thank you. :)

Sergey Alexandrovich Kryukov 14-Aug-12 16:10pm

You are very welcome.
Good luck, call again.
--SA

[no name] 14-Aug-12 16:05pm

Stay hungry..stay foolish :)

Albert Holguin 14-Aug-12 20:25pm

I believe Windows does this on some of their system files...

Sergey Alexandrovich Kryukov 15-Aug-12 0:04am

How could it do it? Yes, if a file is opened by some process, Windows can tell you which one. (See, for example, Sysinternals Handle.exe.) But if the file is written and closed -- too late.
--SA

Albert Holguin 15-Aug-12 10:12am

Try to overwrite some of your vital system files (not really recommended)... you'll see Windows will detect this and just undo what you did. I don't know exactly how they do it but they have some sort of detection (I've never been curious enough to try to figure out how).

Sergey Alexandrovich Kryukov 15-Aug-12 13:13pm

Well, do you agree that if the file is written and closed, it's too late to see what changed it? Overriding vital system files is hardly possible -- they are protected (by one of the way OP was looking for :-).
--SA

Albert Holguin 15-Aug-12 15:23pm

Well, seeing what changed it would be the nearly impossible task, I do agree with that.