Develop Reference

Is there a possibility to prevent files from deleting in specified directory?

I have following situation: I am monitoring a folder with the FileSystemWatcher class from .NET (C#). With this class I get to know if a file was deleted but I want the following behaviour: Prevent the file from deleting by cancel deleting and move the file to my own temp directory to give the user the possibility to restore the file.
Is there a possibility to implement such a behaviour? What is the way I have to go?
Can I hook into some global events? Is it only possibible with an own file system driver?
Or have I to restore the file after getting to know that it was deleted by my own with WinAPI function CreateFile?
Thanks in advance for your help

The FileSystemWatcher does not provide any mechanisms to intercept file deletes, only report to you what has happened.
How big are the files in question? Depending on the size of these files, one way to achieve (i.e. hack) this is to cache the files elsewhere, out of sight, e.g. in memory or on disk. When your app starts, run through the files and cache them (copy them to a temporary folder or load them into memory). Update the cache when files are changed or created, and provide a way to restore them when they are deleted. It's not pretty, but it would get the job done.

Who Change the file?

I´m writing a C# Program which record all changes in a UNC Path.
I use the File-System-Watcher in c# to record all changes in my file \D/X/Y(UNC path).
It works very good but now my question: how is it possible to record the Client which change/delete etc. the file ?
EDIT: The UNC Path will be seen in the whole network and I want to record which user change/delete etc a file in the UNC Path (Every one in the network can change the files). Each edit will be saved in real time in a .txt file. So that i can see :
who:PC2 what:change file:X
who:PC1 what:delet file:Y

Use the following code to get the credentials of the user that is logged in
string currentUser = System.Security.Principal.WindowsIdentity.GetCurrent().Name;
If you put this wherever the code is for the file change/deletion is, this should work.
Take a look at this
You basically need to create an auditing process for this, I'm not aware there is a built in way to find information such as who last changed a file.

I'm not sure what you mean by "who" is claiming or modifying a file. As far as I am aware, you can view properties of a file (if you have permissions to view the permissions), the current user (see Jacooobley's answer), and the process that is locking the file.
I don't believe you can see the user who has last effected the file.

How to detect block level changes in a file in C#?

How I may know which file is modified and what data is changed in the file?
Edit: I want to watch the file as it gets modified and then compare it against a previous version to know which data blocks are changed. I guess watching the file for changes can be accomplished by using file watcher API but I have no idea about the second part.

You may need the FileSystemWatcher class.

The most common approach is define FileSystemWatcher, subscribe to its events and process them accordingly to the logic of your application.
Here is a simple example.

C# Detect file moves trough different folders

I want to detect every filechanges on a specific folder (except data changes). I decided to use System.IO.FileSystemWatcher to manage that.
//
// fileSysWatchFile
//
this.fileSysWatchFile.EnableRaisingEvents = true;
this.fileSysWatchFile.IncludeSubdirectories = true;
this.fileSysWatchFile.NotifyFilter = System.IO.NotifyFilters.FileName;
this.fileSysWatchFile.SynchronizingObject = this;
this.fileSysWatchFile.Created += new System.IO.FileSystemEventHandler(this.fileSysWatchFile_Created);
this.fileSysWatchFile.Deleted += new System.IO.FileSystemEventHandler(this.fileSysWatchFile_Deleted);
this.fileSysWatchFile.Renamed += new System.IO.RenamedEventHandler(this.fileSysWatchFile_Renamed);
As far as good... New files are detected. File deletes are detected. File renames are detected.
When I move a file to a subfolder it detects first a file delete and then a new file create.
I'd expect that a move is the same as a rename except the path. Seems that it isn't. Can I detect file moves in a save way?
By the way... I only want to detect file changes and not directory changes.
Edit:
Additional Info why I have to detect moves and can't live with delete, create:
I want to replay the same changes on an other drive. If I get a delete first, I delete the shadow file. Then I get the create file event and the original file is already lost :-(.
So I have a drive A which is the watched drive...
And a drive B which has files with the same filenames.
All file changes exept data changes should be replayed on drive B.

The File delete / File create functionality is what is behind a file move. It's similar to rename if you are just moving a file from a folder to a folder, but what about if moving a file from one disk to another, or moving a file between machines?
And, If I'm watching a specified folder, as long as the file is not there, it might as well have been deleted :)
If you are sure that you want to catch file moved "events" (from a watched folder to a watched subfolder), I would maintain a list of recently deleted files, and upon every file created event, check if the file is it that list, indicating a de facto file move.

You can use file system filter driver to track file rename operation. Actually, FS Filter is better approach, than FileSystemWatcher. FileSystemWatcher doesn't provide reliability and flexibility for certain cases (you can see the number of questions regarding FileSystemWatcher and it's glitches and limitations).
FS Filter lets you track the requests as soon as they reach the file system.
You can write your own filter driver, or use our CallbackFilter product.

It's not a real solution of the problem, but I managed to have a quick and dirty solution:
First I am buffering all events for a while (tested with 100ms but we will see how fast it can go).
If a event is 100ms in the buffer I check if there is a depending other event also in there. So for Delete I search all creates and for create I search all deletes.
If I find one I replace the two events with only one move event.
There are some riscs with this workarround:
1.) I can't say what comes first, delete or create. Seems that this is every time different
2.) If the delay is to short, the file is deleted and lost :-(
But as long as I have no better solution I have to live with this.

Program needs to read file everytime it changes

I have a program that reads an XML file (for now, on local computer.) and loads the data into a list of struct.
How can I make it such that if I execute it, it does the above but then waits to keep checking for any change to the file. Should the file be changed, it reads the file all over again.
Do I need to create a file watcher service as described here:
http://www.codeproject.com/KB/files/C__FileWatcher.aspx

You need FileSystemWatcher - the docs give examples.
Basically you create an instance, give it a filter (which would be your exact file in this case), hook up an event handler (probably the Changed event in your case) and then set EnableRaisingEvents to true.

You'll want to look at the System.IO.FileSystemWatcher class. You can have it raise an event in your code when the file is changed.
Details can be found on MSDN: http://msdn.microsoft.com/en-us/library/system.io.filesystemwatcher.aspx

Look at the FileSystemWatcher class. You can point it at your XML file and when it changes, it will fire an event so you can then read the file again