Is it possible to detect if files on a drive were changed without scanning the drive?

[Claudio Grondi]

"Alessandro Bottoni" <alessandro.bottoni at infinito.it> schrieb im Newsbeitrag
news:O7iVe.98$m56.2108 at twister1.libero.it...
> Claudio Grondi wrote:
> > After connecting a drive to the system (via USB
> > or IDE) I would like to be able to see within seconds
> > if there were changes in the file system of that drive
> > since last check (250 GB drive with about four million
> > files on it).
> >
> > How to accomplish this? (best if providing
> > directly a Python receipe for it :-)
> > Do available file systems have something like
> > archive attribute assigned to the root directory
> > of the drive?
> > I suppose not. Am I right?
>
> On Linux there is the FAM (File Alteration Module) for this, as long as I
> know. Maybe Python has a wrapper/binding for it.
>
> > I ask this question having Microsoft Windows 2000
> > and Windows proprietary NTFS file system in mind,
> > but I am also interested to know it about Linux or
> > Unix file systems.
>
> As long as I know, on Windows there are a few specific "hooks" to perform
> such a task. They are provided by the MS API for the NTFS/HPFS file
> systems. I do not think Python implements anything so "low level", anyway.
> Check the docu to be sure.
>
> > I know, that looking for the archive attribute of the
> > top directories doesn't help when the change
> > happened to files somewhere deeper in the
> > hierarchy of directories.
>
> Right. It does not help.
>
> Consider this: if are accessing a network file system, you can intercepts
> the calls to the virtualization layer (NFS or NetBIOS). Most likely,
Python
> can support you in performing this task.
>
> HTH
> -----------------------------------
> Alessandro Bottoni

Thank you for your response.

To be more clear I should maybe add, that I have not to do with
drives beeing altered while the system is running. The drives content
can be altered e.g. by the computer of a friend who I gave the drive
out to.
I tell it here, because it seems, that the answer is biased
towards detecting changes done to files on a drive while
running on a system able to monitor the drives activity.

Claudio