10 Free Tools to Monitor Files & Folders Changes in Real Time
6. Phrozen Windows Files Monitor
Although the Phrozen website no longer lists or even mentions its own tool, Windows Files Monitor still works. The program itself is portable and can monitor almost 20 different events. These include attributes, create, delete, rename, update, and association. There’s also some other system events like drive and media remove/add, network share/unshare, and server disconnect. Each can be disabled in the settings.
Only whole drives are monitored and all installed drives are selected for monitoring by default. If you want to disable a drive, go to the settings > “Drives to Monitor”. However, we found the drive selection a bit buggy and the options don’t stick. You can use an exclusion on specific drives (or folders) for a more permanent solution. A capture only selected extensions option is available in the same window as the exclusions.
Just press Record to begin monitoring and the results will appear in the window in a list or tree format. Results can be saved to a text log file.
Download Phrozen Windows Files Monitor
7. FolderChangesView
FolderChangesView is another tiny, simple, and portable utility from Nirsoft that can actively monitor files, folders or complete drives in real time. It tells you which files have been modified, created, deleted, or renamed. FolderChangesView offers to play a sound on an event trigger, execute a command or script on a new/updated item, and save a log file at specific intervals in text, HTML, or XML format.
When started, a window will ask for all base folders to monitor in a comma delimited list and a checkbox for optionally monitoring all subfolders. There’s also comma delimited lists available for folder exclusions and file show/hide wildcards. The folder exclusion list allows you to add partial folder names or names that will match several folders if you want.
The window will list all files that have been modified, created, renamed, or deleted since monitoring began in a list format and a counter for each file of the possible actions. Other information such as the full path to the file, its extension, owner, and event time is also displayed. Monitoring can easily be stopped or started using the buttons on the toolbar.
8. SpyMe Tools
SpyMe Tools is a bit of a dual role utility because it can also perform before and after snapshots to compare after monitoring software installs. This tool has also been mentioned in our Tracking Registry and Files Changes When Installing Software in Windows article. It does, however, have a real time function to monitor files and can also monitor a selected folder or a whole drive. Portable or setup installer versions are available.
When you run SpyMe Tools, look for the “Current Mode” in the toolbar and click the file icon. Then click the “Real time Monitor” icon to the right to open the configuration window. The program can watch for file and folder actions including create, delete, rename, timestamp changes, and optionally disable file or folder monitoring. Select the drive(s) or a specified folder, set a wildcard if needed to watch for certain types of files, and then switch to the View tab to start monitoring.
Download SpyMe Tools | Download ApyMe Tools Portable
9. Track Folder Changes
Track Folder Changes is a very simple, small, and portable tool to operate and has no options to configure at all. The type of changes to files and folders it can detect is also slightly less than some other programs but is still able to identify when they are created, modified, or deleted. Windows 10 users will be offered .NET Framework 3.5 for installation if it’s not already installed.
By default, Track Folder Changes will start to monitor the whole C drive which will obviously create a lot of action and is easily changed to a specific folder with the browse button. All actions are displayed in real time and the complete directory tree to a change will be expanded. Any changes detected to files or folders are color coded; green is newly created, blue is modified and orange is deleted.
If a file is renamed you will get an orange and a green entry because the program sees it as the old file being removed and a new file created in its place. You can open the file or folder, go to its location or copy the path via right clicking on the entry.
10. Moo0 File Monitor
This is another tool that is very easy to use with pretty much everything contained within a single window. Moo0 File Monitor does have a few options compared to Track Folder Changes but it’s not overloaded and they’re not complicated. Monitoring watches file and folder activity for create, write, rename, and delete. Each can be enabled or disabled using the checkboxes at the top.
The other checkboxes are to control which drives are monitored. There is no option to watch specific folders, just whole partitions including external drives. Some options are available in the View menu, such as window refresh frequency, display log size, window skins, and different languages. The save log button at the bottom right saves the display log data to an HTML page. Both portable and installer versions are available.
Final Note: Other useful tools to monitor files and folders in real time that are not listed here include File Watcher Utilities and DaemonFS. One tool we would advise caution over is Free Folder Monitor as it can install adware during setup even if you opt out. Extracting the installer with something like Universal Extractor and using the program portably does get around the issue.
Although not included here, a favorite techie’s tool Process Monitor could also be configured to perform these functions in some capacity. The problem is setting it up to monitor files and folders for create/delete/rename actions is really not that easy and requires extensive use of the filters function.
TheFolderSpy does not pass VirusTotal. Loaded with Trajans
I use Tweakeze and so far so good! I liked that it runs on the background keeping things in check.
Disk Pulse is excellent. Watch 4 Folder got almost nothing writing on the hdd, TheFolderSpy got so much that it craches all the time.
Hello,
I have used the Nirsoft product but found that upon reboot (Windows 7) it “forgot” the settings. Again, if I am missing something that would allow the settings to “stick,” I’d be happy to know about it. Thanks!
Try to launch the product as an administrator and set the settings…
Hello,
As far as I can tell, Watch 4 Folder does not work with “hidden” folders. If I am incorrect, however, I’d love to know that because I think W4F would otherwise be ideal for my purposes. Thanks!
Regarding File Alert Monitor, I am not sure that qualifies as a free program because if you read the terms of service, it states you have license to use this software if you have purchased other software from the company. If you are a stickler for licensing, you may want to look at other products. It does work great though.
Nowhere does it say you are not allowed to use this tool if you don’t own a license, only that registered users of their other products can install it as many times as they like. Therefore, non license holders are not breaking the terms of the license.
If the intention was for nobody to use it but license holders, the terms are incredibly badly written and don’t stand up to any scrutiny.
Anyway, the website itself says it is “freeware”.
Hi! Yes, awesome review! Any idea of which programs are compatible with Apple? I want to set up a system where different folders in my office server are “assigned” to different colleagues so each of us gets notifications about changes to their assigned files/folders. Are these kinds of collaborative monitoring processes supported by these programs?
Hi! I am trying to track changes in a folder with music files. From time to time there are some changes in the files that are bothering me like date modified, metadata info or even all the bytes in the file are changed. I think it is related to the player. Although i disabled the features that allows the player to update metadata or file information through the internet, these file changes keep happening.
I want to track what program makes those file changes, so can you recommend me some software that tracks not only the changes but the program responsible for those changes?
Thank you!
Thanks for the clear overview. I downloaded the portable version of Directory Monitor, which seems pretty good even with the free feature set.
I have a folder, part of a larger tree backup I made some months ago that reappears time and again for no reason at all.
Could you please help me with the way to find what is copying it again in the same old folder that was backed up from?
Many thanks.
The tools here won’t do what you are looking for, have a look at this:
https://www.raymond.cc/blog/find-out-what-program-is-secretly-accessing-your-hard-disk-drive/
Use one of those methods to watch and see what process is accessing your drive.
Hi, what if I have a network storage server and want to know which PC or IP (Invected by a virus) that create or modified a file or folder in the network drive so I can track it down.
Hi,
Great review and very helpful! I’m looking for package that also tracks copy or move operations and records the destination folder. Does any of these do that?
Thanks.
#10 (File Alert Monitor) on page 2 redirects to transcriptionbuddy webpage.
Perhaps the link could be updated with the one from Download dot com, or removed?
Thanks for the report, I’ve updated the link to show the original page at the internet archive where both installer and portable versions can still be downloaded.
Hi! Thank you for you job. This is great post, and I just wanted to ask if one of this programs has a record which other app or user manually deletes or modifies the targeted file. For example, Norton360, or uninstaller, or something else. Thank you.
Some of the tools can tell you which user account deleted/modified the files but they can’t tell you specific users if several are working under the same account.
Hey there, any chance that one of these are also reporting the user that made the change to the fie/folder? I’m trying to watch over a file server, but I really need to know which user made the change, just knowing that a change was made is only the (unusable) half of the solution :(
Thanks
Sorry, it was actually pretty obvious – TheFolderSpy. I have already installed and setup, it looks very good to me so far, does exactly the job I needed it to do :)
Thanks a lot for this article!
TheFolderSpy might do want you want, it appears to show under which account the change was made, that might be enough.
Sysinternal’s Process Monitor might also be interesting.
We already mention Process Monitor at the bottom of the article, but it just needs too much filtering to make it easy to use.
Thanks RayMan!
I’m trying to GRASP stuff that’s over my paygrade. Do any of these apps (or any others you’re aware of) report WHAT the changes are (re file changes)?
I’m looking for an INI-Mon. Ideally one with a smart UI…
Thinking about running a local Sourcetree or something, to see what happens when (for example) I map a controller to a VST param (struggling to understand the hierarchy of config, projects, keymaps, and templates!)
Do any of these tools tell us which file made the change (like a Trojan for example)
thanks
I’m not sure any of them do although I can’t be 100% sure. You may need some kind of HIPS software for that.
You can checkout LepideAuditor Suite which exactly meets to your concern. It helps to track every critical changes/access made on file server into real time and alerts instantly by sending customized email notification.
“Watch 4 Folder” has a virus. Nice!
Incorrect, the installer version is ad supported which is not a virus, it’s adware. The portable version is entirely clean of adware.
Watch 4 Folder v2.3 (with bug fixed – W4FInstallFixed.exe) installs Consumer Input adware. New version 2.5 has free / paid version, but I’m reluctant to try due to adware.
I have tested
Febooti Automatic Workshop and
Filesure
both are good
Adam
Thank you for this post. Very very useful for me
thank you very much