The EaseFilter File Access Monitor SDK enables the development of Windows applications for file auditing and monitoring. It offers real-time monitoring of file changes and access, allowing for interception of file I/O requests. This includes capturing file open and creation events.

One of the key features of the EaseFilter File Access Monitor SDK is the ability to create a detailed file access log. This log provides information about who accessed which files, when they were accessed, and the specific actions that were performed. With this level of visibility, you can track and monitor user and file activities, permission changes, storage capacity, and generate real-time audit reports.
The EaseFilter File Access Monitor SDK functions as a file system filter driver, which operates in kernel-mode as part of the Windows executive. This filter driver can intercept requests that are targeted at a file system or another file system filter driver. By intercepting these requests, the filter driver can extend or replace the functionality provided by the original target. This means you have greater control over I/O operations for one or more file systems or file system volumes.
Additionally, the EaseFilter File Monitor SDK provides notifications for specific events related to managed files. You can receive notifications for file creation, file deletion, file renaming, file writing, file security changes, and file information changes. These notifications allow you to stay informed about any important changes that occur to your managed files.
Overall, the EaseFilter File Access Monitor SDK is a comprehensive and flexible tool that enables developers to create robust file audit and file monitor applications. With its ability to intercept file I/O requests, track user and file activities, and provide detailed notifications, this SDK offers a powerful solution for managing and monitoring file access.
Version 5.2.4.1:
1. Fixed a registry filter modification callback issue.
2. Fixed an offset/length issue when monitor the read or write operations from SMB.