I’m exploring whether Everything can help track when files are opened (not just created/modified) across the whole system — similar to how Date Modified is reliably indexed via the USN Journal.
As far as I understand: Date Accessed depends entirely on NTFS’s own last-access tracking (disabled by default since Vista), and Run Count/Date Run only update when a file is opened through Everything itself or when an external app explicitly calls Everything_IncRunCountFromFileName.
Is there any lightweight, officially supported way to have Everything observe file-open events system-wide — from any application, not just Everything’s own UI — without running a separate always-on background listener (e.g. ETW-based)? Or is that fundamentally outside what Everything’s architecture is designed to do?
Tracking file opens (RunCount)
-
void
- Developer
- Posts: 20166
- Joined: Fri Oct 16, 2009 11:31 pm
Re: Tracking file opens (RunCount)
There's no realistic/efficient way to do this.
Nothing is logged in the USN Journal when you open a file.
You're likely going to need a background listener to hook CreateFile calls.
Not something I really want to do in Everything.
-Not sure if something already exists.
is-open:
Nothing is logged in the USN Journal when you open a file.
You're likely going to need a background listener to hook CreateFile calls.
Not something I really want to do in Everything.
-Not sure if something already exists.
is-open: