[MrDosu]

About every form of backup software will use change journals to identify what to backup and how it changed.

Change journals are streams that are per volume (so to monitor some directory in C:\ i have to monitor the C:\ change stream).

It's just how NTFS works. It's shocking that this was allowed to reach this kind of publicity because it's just a guy attaching a diagnostic tool to a system where he doesn't know whats happening and then proceeds to freak.

Software like this will have plenty of file access for metadata, not only on the backed up files.

[TheLoneWolfling]

And this is where having the API actually support, say, monitoring only items in a single directory would be good.

[MrDosu]

Well there is, but it's unreliable in certain edge cases. At least not reliable enough for a backup solution.

[TheLoneWolfling]

In which case the API is broken and should be fixed.

Also, what edge cases?

[MrDosu]

For example you have to allocate a buffer to hold the information you receive. If that's too small, you miss stuff. There is also a lot of intricacy with permissions and you can mess up a lot when multithreading without knowing how to properly interact with the OS then.

[TheLoneWolfling]

Wouldn't that be worse, if anything, for the whole-drive case?