-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathFileMonitor.ps1
99 lines (83 loc) · 3.08 KB
/
FileMonitor.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
Function Get-FileHashCustom($filepath) {
try {
$filehash = Get-FileHash -Path $filepath -Algorithm SHA512 -ErrorAction Stop
return $filehash
} catch {
Write-Host "Error calculating hash for $filepath" -ForegroundColor Red
return $null
}
}
Function Remove-BaselineIfAlreadyExists {
if (Test-Path -Path .\baseline.txt) {
Remove-Item -Path .\baseline.txt -ErrorAction Stop
}
}
Write-Host ""
Write-Host "What would you like to do?"
Write-Host ""
Write-Host " A) Collect a new Baseline?"
Write-Host " B) Begin monitoring files with the saved Baseline?"
Write-Host ""
$response = Read-Host -Prompt "Please enter 'A' or 'B'"
Write-Host ""
$scriptDirectory = $PSScriptRoot
$filesDirectory = "$scriptDirectory\Files"
if (-not (Test-Path -Path $filesDirectory)) {
Write-Host "The 'Files' directory does not exist at the expected location: $filesDirectory" -ForegroundColor Red
exit
}
if ($response -eq "A") {
Remove-BaselineIfAlreadyExists
$files = Get-ChildItem -Path $filesDirectory
foreach ($f in $files) {
$hash = Get-FileHashCustom $f.FullName
if ($hash) {
"$($f.FullName)|$($hash.Hash)" | Out-File -FilePath .\baseline.txt -Append
}
}
}
elseif ($response -eq "B") {
$fileHashDictionary = @{}
if (Test-Path -Path "$scriptDirectory\baseline.txt") {
$filePathsAndHashes = Get-Content -Path "$scriptDirectory\baseline.txt"
foreach ($f in $filePathsAndHashes) {
$path, $hash = $f -split '\|'
$fileHashDictionary[$path] = $hash
}
} else {
Write-Host "Baseline file not found!" -ForegroundColor Red
exit
}
while ($true) {
Start-Sleep -Seconds 1
$files = Get-ChildItem -Path $filesDirectory
$keysToRemove = @()
foreach ($f in $files) {
$hash = Get-FileHashCustom $f.FullName
if ($hash) {
if (-not $fileHashDictionary.ContainsKey($f.FullName)) {
Write-Host "$($f.FullName) has been created!" -ForegroundColor Green
$fileHashDictionary[$f.FullName] = $hash.Hash
} else {
if ($fileHashDictionary[$f.FullName] -ne $hash.Hash) {
Write-Host "$($f.FullName) has changed!!!" -ForegroundColor Yellow
}
}
}
$keysToRemove += $f.FullName
}
foreach ($key in $fileHashDictionary.Keys) {
if (-not $keysToRemove.Contains($key)) {
if (-not (Test-Path -Path $key)) {
Write-Host "$($key) has been deleted!" -ForegroundColor DarkRed -BackgroundColor Gray
$keysToRemove += $key
}
}
}
foreach ($key in $keysToRemove) {
$fileHashDictionary.Remove($key)
}
}
} else {
Write-Host "Invalid option entered. Please restart the script and enter 'A' or 'B'." -ForegroundColor Red
}