A few days back, I was asked by my uncle to help him open an XLS file saved on a shared drive on windows machine. The file name was in the list of “recently opened file” in Microsoft Excel, however the file was missing from the original location, hence failed to open. I could not figure out whether file was deleted/moved to another location. That triggered a thought whether there is any tool which monitors the file/directory specific events like open/create, delete, modify, access etc in windows. I do not have windows pc handy, so next thing to try similar thing out on Linux.
Linux has some utilities which can be used to monitor above mentioned file events, called inotify-tools, which can be installed using following command in Ubuntu.
sudo apt-get install intofiy-tools
Following command will monitor the /tmp directory recursively under Linux for create, modify, delete events.
inotifywait -r /tmp/ -e create -e modify -e delete -m --format '%T %w%f %e' --timefmt '%F %k:%M:%S'
More information can be obtained from the man pages of inotifywait command.