"Has written"... maybe. If file is closed after write, FindFirstChangeNotification loop can signal your program and you can 'do something.'
Or maybe the file need not be closed... under FFCN doc we find
FILE_NOTIFY_CHANGE_LAST_WRITE Any change to the last write-time of files in the watched directory or subtree causes a change notification wait operation to return. The operating system detects a change to the last write-time only when the file is written to the disk. For operating systems that use extensive caching, detection occurs only when the cache is sufficiently flushed.
For some reason I have always thought the file has to be closed to result in either one of these notifications to be issued... but I guess testing could determine that.
I don't know there is a "hook" or anything to detect when WriteFile() or any other function is called.
MCM
Leave a comment: