10 Free Tools to Monitor Files & Folders Changes in Real Time
With so many programs working in the background performing their own tasks, it can be quite difficult sometimes to know what is being written, deleted or modified on your drives. There always appears to be something making changes somewhere. Some operations you might be fully aware of such as file downloading, video encoding, antivirus scans etc, but there might also be something writing to the drive when you don’t really expect or want it to.
Being able to monitor files across the board would work, but isn’t really practical. As it would be a thankless task trying to keep watch over all this activity yourself, having a piece of software to help you find out what files are being created or modified could be a real time saver. Thankfully, there are tools around to help you out and keep watching these areas for you, here’s a selection of 10 free programs to have a look at. All tools were tested in Windows 10 and Windows 7 64-bit.
1. Watch 4 FolderWhile performing the task of watching for a number of different actions such as file or folder create, delete, rename or change, Watch 4 Folder can alert you about the change in several different ways. There’s also a few other interesting functions such as watching for a file association change, whether the drive free space has changed and also if a CD/DVD (not USB media) is inserted or ejected.
Trigger alerts can be an ordinary desktop popup window, a custom alert window that appears above the system tray, or executing another program with the changed object optionally supplied as an argument. The events can also be written to an external log file or viewed via the Live Log tab. Press Apply and then Start on the Watch List tab to begin monitoring.
The free version of Watch 4 Folder allows the monitoring of a single folder at a time. The paid version ($4.99) can have up to four folders monitored simultaneously. Watch 4 Folder is portable and compatible with Windows XP up to Windows 10.
2. Disk Pulse
There are five editions of Disk Pulse; four paid and a restricted freeware version. Annoyingly, there is no official information about what those restrictions are. We know from testing, there is a limit of three profiles while email notifications, database logging, and custom actions are disabled. However, file type monitoring, filters, categories, and rules are no longer disabled like they were in older versions.
Disk Pulse will watch file and folder create, modify, rename, and delete changes. Finer controls like name, size, time, and attribute changes are in the profile options. Although there’s only three available profiles, multiple folders to monitor can be added to each. Double click a profile to enter its options. From there you can add multiple rules, exclude folders, and edit the events/main monitor type options.
The Charts option displays a nice bar or pie chart of the changes which can be printed, saved or copied to the clipboard. Save will create a report with several different output formats available. The Wizard button offers some profile presets that are pre-configured for certain scenarios, such as monitoring for image files, newly created files, or Windows system files.
Note: A possible bug we encountered is Disk Pulse will just quit without warning if it has to deal with several thousand events in quick succession, such as when unarchiving or copying. Try to make sure your selected folders won’t have this type of activity during monitoring.
3. TheFolderSpy
This program is able to handle the real time monitoring of multiple folders at once and is a very small portable executable of just over 120KB. TheFolderSpy can watch for creation, deletion, attribute changes, access date, and file size changes. Do note that the downloaded file is a RAR archive so you will need a third party tool such as WinRAR or 7-Zip to extract it. The .NET Framework 3.5 is required for Windows 10 users.
TheFolderSpy has a wildcard option to include certain types of a file although only one can be applied at once. Something that users may find quite useful is a built in email option that can mail you every time an event is triggered. Obviously, this is only suitable for rare events. Any triggered events will show in the main window, optionally a log file, a system tray balloon popup, and a file can be executed including an audio file.
4. Directory Monitor
Although the free version of Directory Monitor is still very capable, it has a huge amount of disabled functions reserved for the paid version. However, unlike Disk Pulse the restrictions are listed on the website. The restrictions include emailing, database options, sound events, printing, inactivity events, snapshots, user event monitoring, running as a service, executing programs in the background, and Growl notifications.
You can quickly add a folder for monitoring by using the text box or the browse button. The disadvantage is only new file events are monitored. To monitor more, either edit the folder or use the Add button which gives the available options when setting up a folder to watch. Then you can add file/folder deletions, modifications, renames, and file access. Multiple folders can be added to the monitor list including network shares.
The folder monitoring options also offer include and exclude wildcard patterns, logging to a text file, and executing a file on an event. Just about everything else there is disabled. If you don’t want the system notifications box appearing every time an event is logged, go to File > Options and turn it off or increase the interval. Directory Monitor has a portable, installer, and Chocolatey version available for download
5. Folder Monitor
Folder Monitor is another portable tool that can monitor file and folder events for creating, changing, renaming, and deleting. It’s only around 300KB in size but has some useful functions to trigger once a change has been detected. Windows 7 users will need .NET Framework 4.5 or above.
Click on the tray icon to open the monitored folder window, right click and choose “Add folder” to browse or “Add path” to paste or type a path in. Multiple folders can be added to the window. Right click on the entry and go to Options where you can choose which events are monitored, execute a command, or add an include/exclude filter using Regex. Each watched folder has its own options.
Other functions are found in the Options in the tray icon context menu. These are global and will affect all monitored folders. From this window, you can change the visual notification to visual (popup window) or balloon, and add a sound notification using a system or custom sound. Folder Monitor also supports a few command line arguments that are found in the About window.
The other remaining 5 file and folder monitoring tools can be found on the next page.
TheFolderSpy does not pass VirusTotal. Loaded with Trajans
I use Tweakeze and so far so good! I liked that it runs on the background keeping things in check.
Disk Pulse is excellent. Watch 4 Folder got almost nothing writing on the hdd, TheFolderSpy got so much that it craches all the time.
Hello,
I have used the Nirsoft product but found that upon reboot (Windows 7) it “forgot” the settings. Again, if I am missing something that would allow the settings to “stick,” I’d be happy to know about it. Thanks!
Try to launch the product as an administrator and set the settings…
Hello,
As far as I can tell, Watch 4 Folder does not work with “hidden” folders. If I am incorrect, however, I’d love to know that because I think W4F would otherwise be ideal for my purposes. Thanks!
Regarding File Alert Monitor, I am not sure that qualifies as a free program because if you read the terms of service, it states you have license to use this software if you have purchased other software from the company. If you are a stickler for licensing, you may want to look at other products. It does work great though.
Nowhere does it say you are not allowed to use this tool if you don’t own a license, only that registered users of their other products can install it as many times as they like. Therefore, non license holders are not breaking the terms of the license.
If the intention was for nobody to use it but license holders, the terms are incredibly badly written and don’t stand up to any scrutiny.
Anyway, the website itself says it is “freeware”.
Hi! Yes, awesome review! Any idea of which programs are compatible with Apple? I want to set up a system where different folders in my office server are “assigned” to different colleagues so each of us gets notifications about changes to their assigned files/folders. Are these kinds of collaborative monitoring processes supported by these programs?
Hi! I am trying to track changes in a folder with music files. From time to time there are some changes in the files that are bothering me like date modified, metadata info or even all the bytes in the file are changed. I think it is related to the player. Although i disabled the features that allows the player to update metadata or file information through the internet, these file changes keep happening.
I want to track what program makes those file changes, so can you recommend me some software that tracks not only the changes but the program responsible for those changes?
Thank you!
Thanks for the clear overview. I downloaded the portable version of Directory Monitor, which seems pretty good even with the free feature set.
I have a folder, part of a larger tree backup I made some months ago that reappears time and again for no reason at all.
Could you please help me with the way to find what is copying it again in the same old folder that was backed up from?
Many thanks.
The tools here won’t do what you are looking for, have a look at this:
https://www.raymond.cc/blog/find-out-what-program-is-secretly-accessing-your-hard-disk-drive/
Use one of those methods to watch and see what process is accessing your drive.
Hi, what if I have a network storage server and want to know which PC or IP (Invected by a virus) that create or modified a file or folder in the network drive so I can track it down.
Hi,
Great review and very helpful! I’m looking for package that also tracks copy or move operations and records the destination folder. Does any of these do that?
Thanks.
#10 (File Alert Monitor) on page 2 redirects to transcriptionbuddy webpage.
Perhaps the link could be updated with the one from Download dot com, or removed?
Thanks for the report, I’ve updated the link to show the original page at the internet archive where both installer and portable versions can still be downloaded.
Hi! Thank you for you job. This is great post, and I just wanted to ask if one of this programs has a record which other app or user manually deletes or modifies the targeted file. For example, Norton360, or uninstaller, or something else. Thank you.
Some of the tools can tell you which user account deleted/modified the files but they can’t tell you specific users if several are working under the same account.
Hey there, any chance that one of these are also reporting the user that made the change to the fie/folder? I’m trying to watch over a file server, but I really need to know which user made the change, just knowing that a change was made is only the (unusable) half of the solution :(
Thanks
Sorry, it was actually pretty obvious – TheFolderSpy. I have already installed and setup, it looks very good to me so far, does exactly the job I needed it to do :)
Thanks a lot for this article!
TheFolderSpy might do want you want, it appears to show under which account the change was made, that might be enough.
Sysinternal’s Process Monitor might also be interesting.
We already mention Process Monitor at the bottom of the article, but it just needs too much filtering to make it easy to use.
Thanks RayMan!
I’m trying to GRASP stuff that’s over my paygrade. Do any of these apps (or any others you’re aware of) report WHAT the changes are (re file changes)?
I’m looking for an INI-Mon. Ideally one with a smart UI…
Thinking about running a local Sourcetree or something, to see what happens when (for example) I map a controller to a VST param (struggling to understand the hierarchy of config, projects, keymaps, and templates!)
Do any of these tools tell us which file made the change (like a Trojan for example)
thanks
I’m not sure any of them do although I can’t be 100% sure. You may need some kind of HIPS software for that.
You can checkout LepideAuditor Suite which exactly meets to your concern. It helps to track every critical changes/access made on file server into real time and alerts instantly by sending customized email notification.
“Watch 4 Folder” has a virus. Nice!
Incorrect, the installer version is ad supported which is not a virus, it’s adware. The portable version is entirely clean of adware.
Watch 4 Folder v2.3 (with bug fixed – W4FInstallFixed.exe) installs Consumer Input adware. New version 2.5 has free / paid version, but I’m reluctant to try due to adware.
I have tested
Febooti Automatic Workshop and
Filesure
both are good
Adam
Thank you for this post. Very very useful for me
thank you very much