14 DAY TRIAL // In the background, your computer is a busy little bee that runs a lot of activities, from automatically downloading and applying all sorts of updates, to various other tasks that can improve overall performance.
Apart from the OS itself, the installed applications can run a wide range of tasks themselves.
Keeping track of all the modifications happening in the background is impossible without a tool that monitors and records them. Phrozen Windows File Monitor has been created for this exact purpose and it comes free of charge.
The developer created it to function right out of the box, without the need to install it on the system. You can just launch the executable and start watching what activity takes place on your computer.
The interface is minimalistic and straight to the point, with the log window dominating the scene and a short set of options available at the top of the screen to adjust the viewing of the captured information.
To start grabbing the details you have to hit the “Record” button right under the title bar, which will then offer the possibility to stop or pause the process.
By default, all the recorded details are presented in a tree structure, which provides an easier grasp of the locations where the action takes place. However, the report can also be presented as a list.
Both modes are useful, depending on the snippet of info you target. Having everything in a list is more comprehensive in terms of the actual change that occurred.
An impressive number of entries is gathered in a short amount of time when Phrozen Windows File Monitor is allowed to capture the details on its own, with the default set up. This makes wading through the report a tough job but you can customize the application so that it limits the report to the changes you want to see.
The configuration panel offers the possibility to restrict monitoring to specific drives and to certain types of actions. Initially, all drives are selected and there is no filter for the events.
Mind that all adjustments must be made when the program is not engaged with keeping track of the changes.
The most important part of the application is its ability to determine and record events occurring on the system, and Phrozen Windows File Monitor does come prepared for the job.
A set of 19 actions can be tracked as the developer did not stop at the simple ones such as creating, deleting, or renaming a file or folder. Along with these, there is support for actions that associate a file with a specific program, adding or removing a drive to and from the system, updating a directory or file, as well as sharing data on the network.
There is also an entry in the list that can have the program track down attribute changing. During our tests all the events were successfully recorded by the application.
Another useful option that can reduce the amount of entries in the log is configuring the program to take into consideration only specific file types and creating an exclusion list with locations that should not be monitored.
This can be done from the “Extension and Folders“ section of the configuration panel. Some places that should be exempt from the check are temporary locations, because they can record hectic activity.
Phrozen Windows File Monitor comes in handy when installing new software but also if you’re trying to detect suspicious activity on the system.
On the other hand, there is plenty of room for improvement. Among the desirable features is adding a timestamp to all the actions, not just those that delete a file.
Also, the same action is reported for more than one type of change. For instance, both changing the attribute and making some modifications inside a document are labeled as a file update. Creating a new item, renaming, or deleting it is clearly marked with the proper name of the modification.
Still on the downside, sometimes we noticed entries that had no file name or work path and the only detail available was that the action recorded consisted in updating an image.
The Good
You can create a list of specific extensions to be monitored, as well as a list with excluded locations.
