======================================================================

Windows NT File Monitor
Copyright (C) 1996 Mark Russinovich and Bryce Cogswell

======================================================================

FILEMON is a Windows NT GUI/device driver combination that intercepts
and displays information about all file system activity on a Windows
NT system. File systems monitored include FAT, HPFS, NTFS, CDFS,
network redirectors and ram drives.  Information displayed includes
the request type, full pathname of the request target file, return
status, and additional information specific to the request, such as
read/write offsets and lengths.  Even direct access of drives
performed by utilities such as FORMAT and CHKDSK are visible to FILEMON. 

Installation and Usage
----------------------

Running FILEMON is as easy as typing "FILEMON" in the install
directory. The FILEMON device driver, FILEMON.SYS, is automatically
loaded and then unloaded when FILEMON exits.

By default, FILEMON monitors all non-removable drives on the
system. The DRIVES menu indicates which drives are being watched by
check-marking those drives. The monitoring status of a drive, such
as a removable drive like a floppy, can be toggled at any time by
selecting a drive letter in the DRIVES menu.

Reaching Us
-----------

Mark can be reached at markr@numega.com and Bryce can be reached at
cogswell@cs.uoregon.edu.








