Is it possible to detect if files on a drive were changed without scanning the drive?

[Alessandro Bottoni]

Claudio Grondi wrote:
> After connecting a drive to the system (via USB
> or IDE) I would like to be able to see within seconds
> if there were changes in the file system of that drive
> since last check (250 GB drive with about four million
> files on it).
> 
> How to accomplish this? (best if providing
> directly a Python receipe for it :-)
> Do available file systems have something like
> archive attribute assigned to the root directory
> of the drive?
> I suppose not. Am I right?

On Linux there is the FAM (File Alteration Module) for this, as long as I
know. Maybe Python has a wrapper/binding for it.

> I ask this question having Microsoft Windows 2000
> and Windows proprietary NTFS file system in mind,
> but I am also interested to know it about Linux or
> Unix file systems.

As long as I know, on Windows there are a few specific "hooks" to perform
such a task. They are provided by the MS API for the NTFS/HPFS file
systems. I do not think Python implements anything so "low level", anyway.
Check the docu to be sure.

> I know, that looking for the archive attribute of the
> top directories doesn't help when the change
> happened to files somewhere deeper in the
> hierarchy of directories.

Right. It does not help.

Consider this: if are accessing a network file system, you can intercepts
the calls to the virtualization layer (NFS or NetBIOS). Most likely, Python
can support you in performing this task.

HTH
-----------------------------------
Alessandro Bottoni