11 replies to this topic

[kakarukeys]

Is there a way to get a list of files recently saved by the user using any programs in Windows?

[dargueta]

In the registry, look under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs.

[kakarukeys]

that is a list of documents recently opened, not documents recently saved.

[kakarukeys]

It does not work too.
Some files could be created/modified by windows, especially during installation of new programs, etc.

Thank you for the replies so far.
This problem is hard, I see no windows API could provide the function.

[dargueta]

So what kinds of files are you mainly looking for, exactly? System files, or user files?

[kakarukeys]

user files, all files saved by the user in any programs in the last 3 days.

[dargueta]

I think you'd have to do a search for that, like Jordan suggested, but limit it to places where users typically save files like in C:\Documents and Settings (or C:\Users on Vista)

[kakarukeys]

thinking the same thing, it is an "approximation" to the real solution.
if the real solution could not be found, I am prepared to use the "approximation".

I am thinking, when a user is saving a file, there should be a file handle being used.
win32 api does provide a function to extract info from a file handle, the question is,
how do I get the list of file handles?

[dargueta]

That wouldn't work. Handles aren't global - handle 0x00000004 on Process A could point to something else on Process B, or be invalid. I think there's a handle duplication API function, but I can't remember at the moment.

[dargueta]

Once again, I've proven myself wrong.

Enumerating process handles

There's an undocumented command ID you can pass to this function called SystemHandleInformation. There's nothing about it on MSDN, but someone figured it out. You do have to elevate your privilege levels to execute the function, though. This'll probably set off Vista's UAC, but it should be okay on previous versions of Windows.

EDIT:
Source code for doing almost exactly what you wanted to do: OSR's ntfsd List: ObQueryNameString doesn't return

[kakarukeys]

Thank you. That helps.