File Integrity Monitor Windows Service

Project roadmap

1. 01

   Take a baseline snapshot

   ~2h

   Create a project with dotnet new worker. Write a Baseline class that walks the configured folders, computes a SHA-256 hash of each file (streaming it, so large files don't fill memory) and stores the path, size, last modified time and hash in a JSON file (with System.Text.Json) or SQLite. Skip files that can't be read and log them. Done when: the baseline file lists every file in a test folder with its hash.

2. 02

   Watch for file events

   ~2h

   Create a FileSystemWatcher for each folder with IncludeSubdirectories, handling Created, Changed, Deleted and Renamed. Increase InternalBufferSize, and handle the Error event (raised when too many events arrive at once) by rescanning the folder. Handle events quickly and pass them to a Channel, processed by the worker's loop, since the watcher's callbacks shouldn't do slow work. Done when: changing, adding, deleting and renaming files in a test folder produces events in the log.

3. 03

   Confirm real changes

   ~2h

   One save can raise several Changed events, and some don't change the content. Wait a moment after the last event for a file (debounce), then recompute its hash and compare it with the baseline: report a modification only when the hash differs, and handle files still being written (retry when the file is locked). Update the baseline after reporting. Done when: saving a file once produces exactly one alert, and touching a file without changing it produces none.

4. 04

   Log integrity events

   ~1.5h

   Log each confirmed change as a structured event with the time, change type (added, modified, deleted or renamed), path, old and new hash, and file size, to the console and to a rolling log file (for example with Serilog). On Windows, also write to the Windows Event Log. Done when: every change appears once in the log with all its details.

5. 05

   Make it configurable

   ~1.5h

   Read the folders to watch, exclude patterns (such as *.tmp and logs folders), the debounce time and the baseline location from appsettings.json with the options pattern, validating them at startup. Add a full rescan every few hours to catch changes missed while the service was stopped. Done when: excluded files never raise alerts, and a change made while the service was stopped is reported at startup.

6. 06

   Install it as a service

   ~1.5h

   Add UseWindowsService (and UseSystemd for Linux). Publish the app and install it with sc.exe create on Windows, or a systemd unit file on Linux. Document the installation and removal steps in README.md. Check the service starts at boot and stops cleanly. Done when: the service runs in the background after installation and keeps logging changes.

7. 07

   Test it

   ~2h

   Write xUnit tests with temporary folders: baseline creation, detection of each change type, no alert when content is unchanged, debouncing several events, excluded patterns, and detecting changes made while stopped. Done when: dotnet test passes.

Resources

• DocsFileSystemWatcher class
• DocsWorker Services in .NET
• DocsCreate a Windows Service using BackgroundService
• DocsSHA256 class
• DocsSerilog