日期:2014-05-18  浏览次数:21198 次

C# 记录电脑操作记录
大家好,目前需要实现一个记录电脑操作的功能,当软件运行后,自动将对电脑的所有操作记录到txt到,比如删除文件、创建文件、移动文件等等,hook只能实现鼠标动到哪里,按了什么键,比较麻烦,C# FileSystemWatcher也是指定文件夹进行检测,无法对所有文件夹进行监测。大家有什么好想法没?

------解决方案--------------------
hook文件操作的API
------解决方案--------------------
C# code

 private System.IO.FileSystemWatcher watcher = null;
 
 //Button1的点击事件处理
 private void Button1_Click(object sender, System.EventArgs e)
 {
     if (watcher != null) return;
 
     watcher = new System.IO.FileSystemWatcher();
     //指定监测的路径
     watcher.Path = @"C:\My Documents";
     //监测最终存取时间,最终更新时间,文件和文件夹名的变更
     watcher.NotifyFilter =
         (System.IO.NotifyFilters.LastAccess 
         | System.IO.NotifyFilters.LastWrite
         | System.IO.NotifyFilters.FileName 
         | System.IO.NotifyFilters.DirectoryName);
     //监测所有的文件
     watcher.Filter = "";
     //配置UI的线程
     //没有必要使用控制台应用程序
     watcher.SynchronizingObject = this;
 
     //事件处理的追加
     watcher.Changed += new System.IO.FileSystemEventHandler(watcher_Changed);
     watcher.Created += new System.IO.FileSystemEventHandler(watcher_Changed);
     watcher.Deleted += new System.IO.FileSystemEventHandler(watcher_Changed);
     watcher.Renamed += new System.IO.RenamedEventHandler(watcher_Renamed);
 
     //开始监测
     watcher.EnableRaisingEvents = true;
     Console.WriteLine("开始监测");
 }
 
 //Button2的点击事件处理
 private void Button2_Click(object sender, System.EventArgs e)
 {
     //结束监测
     watcher.EnableRaisingEvents = false;
     watcher.Dispose();
     watcher = null;
     Console.WriteLine("结束监测");
 }
 
 //事件处理
 private void watcher_Changed(System.Object source,
     System.IO.FileSystemEventArgs e)
 {
     switch (e.ChangeType)
     {
         case System.IO.WatcherChangeTypes.Changed:
             Console.WriteLine(
                 "文件「" + e.FullPath + "」被改变了。");
             break;
         case System.IO.WatcherChangeTypes.Created:
             Console.WriteLine(
                 "文件「" + e.FullPath + "」被做成了。");
             break;
         case System.IO.WatcherChangeTypes.Deleted:
             Console.WriteLine(
                 "文件「" + e.FullPath + "」被删除了。");
             break;
     }
 }
 
 private void watcher_Renamed(System.Object source, 
     System.IO.RenamedEventArgs e)
 {
     Console.WriteLine(
         "文件 「" + e.FullPath + "」的名字被改变了。");
 }

------解决方案--------------------
写的不错
up
用ThreadPool 应该比List<Thread>方式管理线程对象好一些吧