Is it possible to detect if files on a drive were changed without scanning the drive?

Alessandro Bottoni alessandro.bottoni at
Mon Sep 12 18:35:58 CEST 2005

Claudio Grondi wrote:
> After connecting a drive to the system (via USB
> or IDE) I would like to be able to see within seconds
> if there were changes in the file system of that drive
> since last check (250 GB drive with about four million
> files on it).
> How to accomplish this? (best if providing
> directly a Python receipe for it :-)
> Do available file systems have something like
> archive attribute assigned to the root directory
> of the drive?
> I suppose not. Am I right?

On Linux there is the FAM (File Alteration Module) for this, as long as I
know. Maybe Python has a wrapper/binding for it.

> I ask this question having Microsoft Windows 2000
> and Windows proprietary NTFS file system in mind,
> but I am also interested to know it about Linux or
> Unix file systems.

As long as I know, on Windows there are a few specific "hooks" to perform
such a task. They are provided by the MS API for the NTFS/HPFS file
systems. I do not think Python implements anything so "low level", anyway.
Check the docu to be sure.

> I know, that looking for the archive attribute of the
> top directories doesn't help when the change
> happened to files somewhere deeper in the
> hierarchy of directories.

Right. It does not help.

Consider this: if are accessing a network file system, you can intercepts
the calls to the virtualization layer (NFS or NetBIOS). Most likely, Python
can support you in performing this task.

Alessandro Bottoni

More information about the Python-list mailing list