FileMon

FileMon: Real-Time File Monitoring Software for Windows

An open-source file monitoring software tracking file access, changes, renames, and deletions in real-time, ideal for monitoring critical files or detecting suspicious activity.

What is FileMon?

FileMon is a free, open-source file monitoring and auditing software for Microsoft Windows. It tracks and logs all attempted file system activity in real-time, including file access, changes, renames, and deletions. This allows administrators and security professionals to monitor access to critical system files and configuration files, troubleshoot application problems related to the file system, detect suspicious activity and policy violations, and more.

Some key features of FileMon include:

• Monitors all file system activity via Windows filter drivers
• Logs file access details like process name, user, time, operation, etc.
• Useful for monitoring critical system files, log files, databases
• Can detect malware, ransomware, or insider threats
• Filters to only monitor specific files, users, processes
• Exports logs to various formats like CSV, JSON, SQLite
• Free and open-source software (GPLv3 license)

With its advanced real-time monitoring and filtering capabilities, FileMon provides deeper visibility into file system activity than native Windows auditing tools. It is widely used by system administrators, IT support teams, security analysts, and forensics professionals.

FileMon Features

Official Links