c++ - How to detect a file move under win32 NTFS? -

i have database allowing attach additional information file file-system (ntfs). file id full path, in order maintain consistency, need watch if of files inside db deleted, renamed or moved.

for moment, trying achieve using readdirectorychangesw function file_notify_change_file_name | file_notify_change_dir_name filter criteria.

the problem way, notifications renaming, creation , deletion. need guess when move occurs, based on 'added' , 'removed' events , related file name (on same volume, move [ctrl-x, ctrl-v] file removal followed file creation, paths differ, file name remains same).

does knows if there better solution ?

here understanding based on observations:

about moving files under ntfs

inside same volume

a 'removed' event followed (with no or little delay) 'added' event same filename , different path (whatever size of moved file).

special case if whole volume being watched: when file deleted added recylce bin (path contains volume recycle bin's filename different [some kind of hash]).

between 2 distinct volumes

first, there 'added' event on destination volume.
afterward, when copy completes, there 'removed' event on original volume.

(note: several events might occur in meanwhile: bigger file, longer lag-time.)

if files under control (if have write access when adding database , have @ least read access), i'd mark them either guid in alternative data stream, or object id (https://msdn.microsoft.com/en-us/library/aa364557%28v=vs.85%29.aspx), whatever more suitable.