Tripwire equivalent for Windows? (script or program)

[hgate73]

I've been searching for a while for a program or script for windows that's equivalent to Tripwire on *nix. Basically something to monitor files in a directory and notify me on either a) modification of files (checksum change) or b) new files in the directory.

I.e. "watch c:\secretfiles\*.exe notify me@mail.com" or something like that. Is anyone using a script or program for this?

I found something called "winfingerprint" but it's not what I'm looking for.

Thanks in advance,

I was previously posting under "GeneralDzur" but hgate73 is my new username.

 

[kjv1611]

Well, I know I've seen applications like this, but I can't remember any names right off hand.

Have you tried searching at any of the free download sites? Some of my favorites:

http://www.download.com,

http://www.filehippo.com,

http://www.softpedia.com,

and

http://www.majorgeeks.com

I find, oftentimes, that if it's not a "mainstream" application, or very well known application, that MajorGeeks or SoftPedia is the best place to look. MajorGeeks in particular keeps even some older non-supported stuff on hand. One such example I always think about is RegScrubXP - not supported in years, but still works excellently, and MajorGeeks still offers it for download.

 

[kjv1611]

Well, with a quick Google search, I found this one, forgot about it:

http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx

 

[hgate73]

Grrr.

"FileMon and Regmon are no longer available for download. They have been replaced by Process Monitor."

Process monitor doesn't do what FileMon does! How can Process Monitor replace it? Now I need to track down a copy of FileMon and see if it'll run on Vista.

:-/

I was previously posting under "GeneralDzur" but hgate73 is my new username.

 

[kjv1611]

Sorry, didn't look further when I saw the name. I'm sure you can find a copy somewhere, but whether or not it'll work on Vista, I've no clue.

You might be better off searching for another. Try searching on Major Geeks, for instance, for "file monitor", and see what you come up with. By the way, they have 2 ways of searching there, like on tek-tips, a site-based search of the site, as well as a google-based search of the site.

 

[hgate73]

Well, I've been digging around sourceforge and google, and found these three possible solutions.

Ranked in order of preference / suitability:

1. Another File Integrity Checker (AFICK), based on a Perl script with a Windows installer and a command-line version (can it get any better??)

2. HDD-Profiler, a directory watcher

3. md5deep and hashdeep, recursively hashes files in a directory structure. I think these could be used in a custom scheduled script pretty easily.

I think AFICK is what I've been looking for. If I have problems with it or it's not what I was expecting I'll post back.


I was previously posting under "GeneralDzur" but hgate73 is my new username.

 

[linney]

Hard to find any freeware but check these out. Whether they run on Vista is another matter?

FileChecker v1.7

http://www.javacoolsoftware.com/filechecker.html

"Live" Folder & File Monitor

http://www.wilderssecurity.com/archive/index.php/t-186272.html

Can you make use of the inbuilt Audit procedure?

Auditing Access to Files

http://www.gregthatcher.com/Papers/IT/audit.aspx