这段代码可以监控所有的设备操作,当你监控到USB设备有读写操作时,即可进行统计,自己修改吧。<br>能用了,最好是发一份给我。<br><br>unit Unit1;<br><br>interface<br><br>uses<br> Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,<br> StdCtrls, shlobj, Activex;<br><br>const<br> SHCNE_RENAMEITEM = $1;<br> SHCNE_CREATE = $2;<br> SHCNE_DELETE = $4;<br> SHCNE_MKDIR = $8;<br> SHCNE_RMDIR = $10;<br> SHCNE_MEDIAINSERTED = $20;<br> SHCNE_MEDIAREMOVED = $40;<br> SHCNE_DRIVEREMOVED = $80;<br> SHCNE_DRIVEADD = $100;<br> SHCNE_NETSHARE = $200;<br> SHCNE_NETUNSHARE = $400;<br> SHCNE_ATTRIBUTES = $800;<br> SHCNE_UPDATEDIR = $1000;<br> SHCNE_UPDATEITEM = $2000;<br> SHCNE_SERVERDISCONNECT = $4000;<br> SHCNE_UPDATEIMAGE = $8000;<br> SHCNE_DRIVEADDGUI = $10000;<br> SHCNE_RENAMEFOLDER = $20000;<br> SHCNE_FREESPACE = $40000;<br> SHCNE_ASSOCCHANGED = $8000000;<br> SHCNE_DISKEVENTS = $2381F;<br> SHCNE_GLOBALEVENTS = $C0581E0;<br> SHCNE_ALLEVENTS = $7FFFFFFF;<br> SHCNE_INTERRUPT = $80000000;<br><br> SHCNF_IDLIST = 0; // LPITEMIDLIST<br> SHCNF_PATHA = $1; // path name<br> SHCNF_PRINTERA = $2; // printer friendly name<br> SHCNF_DWORD = $3; // DWORD<br> SHCNF_PATHW = $5; // path name<br> SHCNF_PRINTERW = $6; // printer friendly name<br> SHCNF_TYPE = $FF;<br><br> SHCNF_FLUSH = $1000;<br><br> SHCNF_FLUSHNOWAIT = $2000;<br> SHCNF_PATH = SHCNF_PATHW;<br> SHCNF_PRINTER = SHCNF_PRINTERW;<br><br> WM_SHNOTIFY = $401;<br> NOERROR = 0;<br><br>type<br> TForm1 = class(TForm)<br> Button1: TButton;<br> Memo1: TMemo;<br> procedure FormClose(Sender: TObject; var Action: TCloseAction);<br> procedure Button1Click(Sender: TObject);<br> procedure FormCreate(Sender: TObject);<br> private<br> { Private declarations }<br> procedure WMShellReg(var Message: TMessage); message WM_SHNOTIFY;<br> public<br> { Public declarations }<br> end;<br><br>type PSHNOTIFYSTRUCT = ^SHNOTIFYSTRUCT;<br> SHNOTIFYSTRUCT = record<br> dwItem1: PItemIDList;<br> dwItem2: PItemIDList;<br> end;<br><br>type PSHFileInfoByte = ^SHFileInfoByte;<br> _SHFileInfoByte = record<br> hIcon: Integer;<br> iIcon: Integer;<br> dwAttributes: Integer;<br> szDisplayName: array[0..259] of char;<br> szTypeName: array[0..79] of char;<br> end;<br> SHFileInfoByte = _SHFileInfoByte;<br><br>type PIDLSTRUCT = ^IDLSTRUCT;<br> _IDLSTRUCT = record<br> pidl: PItemIDList;<br> bWatchSubFolders: Integer;<br> end;<br> IDLSTRUCT = _IDLSTRUCT;<br><br>function SHNotify_Register(hWnd: Integer): Bool;<br>function SHNotify_UnRegister: Bool;<br>function SHEventName(strPath1, strPath2: string; lParam: Integer): string;<br><br>function SHChangeNotifyDeregister(hNotify: Integer): Integer; stdcall;<br>external 'Shell32.dll' index 4;<br>function SHChangeNotifyRegister(hWnd, uFlags, dwEventID, uMSG, cItems: longWord;<br> lpps: PIDLSTRUCT): Integer; stdcall; external 'Shell32.dll' index 2;<br>function SHGetFileInfoPidl(pidl: PItemIDList;<br> dwFileAttributes: Integer;<br> psfib: PSHFileInfoByte;<br> cbFileInfo: Integer;<br> uFlags: Integer): Integer; stdcall;<br>external 'Shell32.dll' name 'SHGetFileInfoA';<br><br>var<br> Form1: TForm1;<br> m_hSHNotify: Integer;<br> m_pidlDesktop: PItemIDList;<br><br>implementation<br><br>{$R *.DFM}<br><br>function SHEventName(strPath1, strPath2: string; lParam: Integer): string;<br>var<br> sEvent: string;<br>begin<br> case lParam of<br> SHCNE_RENAMEITEM: sEvent := '重命名文件' + strPath1 + '为' + strPath2;<br> SHCNE_CREATE: sEvent := '建立文件 文件名:' + strPath1;<br> SHCNE_DELETE: sEvent := '删除文件 文件名:' + strPath1;<br> SHCNE_MKDIR: sEvent := '新建目录 目录名:' + strPath1;<br> SHCNE_RMDIR: sEvent := '删除目录 目录名:' + strPath1;<br> SHCNE_MEDIAINSERTED: sEvent := strPath1 + '中插入可移动存储介质';<br> SHCNE_MEDIAREMOVED: sEvent := strPath1 + '中移去可移动存储介质' + strPath1 + ' ' + strPath2;<br> SHCNE_DRIVEREMOVED: sEvent := '移去驱动器' + strPath1;<br> SHCNE_DRIVEADD: sEvent := '添加驱动器' + strPath1;<br> SHCNE_NETSHARE: sEvent := '设置目录' + strPath1 + '的共享属性';<br> SHCNE_NETUNSHARE: sEvent := '取消目录' + strPath1 + '的共享属性';<br> SHCNF_PRINTERW: sEvent := '****打印*****';<br> SHCNE_ATTRIBUTES: sEvent := '改变文件目录属性 文件名' + strPath1;<br> SHCNE_UPDATEDIR: sEvent := '更新目录' + strPath1;<br> SHCNE_UPDATEITEM: sEvent := '更新文件 文件名:' + strPath1;<br> SHCNE_SERVERDISCONNECT: sEvent := '断开与服务器的连接' + strPath1 + ' ' + strPath2;<br> SHCNE_UPDATEIMAGE: sEvent := 'SHCNE_UPDATEIMAGE';<br> SHCNE_DRIVEADDGUI: sEvent := 'SHCNE_DRIVEADDGUI';<br> SHCNE_RENAMEFOLDER: sEvent := '重命名文件夹' + strPath1 + '为' + strPath2;<br> SHCNE_FREESPACE: sEvent := '磁盘空间大小改变';<br> SHCNE_ASSOCCHANGED: sEvent := '改变文件关联';<br><br> else<br> sEvent := '未知操作' + IntToStr(lParam);<br> end;<br> Result := sEvent;<br>end;<br><br>function SHNotify_Register(hWnd: Integer): Bool;<br>var<br> ps: PIDLSTRUCT;<br>begin<br>{$R-}<br> Result := False;<br> if m_hSHNotify = 0 then<br> begin<br> if SHGetSpecialFolderLocation(0, CSIDL_DESKTOP,<br> m_pidlDesktop) <> NOERROR then<br> Form1.close;<br> if Boolean(m_pidlDesktop) then<br> begin<br>// MoveMemory(ps, nil, sizeof(ps));<br> ps := GetMemory(sizeof(ps));<br> ps.pidl := m_pidlDesktop;<br>// MoveMemory(ps.pidl, m_pidlDesktop, (m_pidlDesktop));<br> ps.bWatchSubFolders := 1;<br><br> // 利用SHChangeNotifyRegister函数注册系统消息处理<br> m_hSHNotify := SHChangeNotifyRegister(hWnd,<br> (SHCNF_TYPE or SHCNF_IDLIST),<br> (SHCNE_ALLEVENTS or SHCNE_INTERRUPT),<br> WM_SHNOTIFY, 1, ps);<br><br> Result := Boolean(m_hSHNotify);<br> FreeMemory(ps);<br> end<br> else<br> // 如果出现错误就使用 CoTaskMemFree函数来释放句柄<br> CoTaskMemFree(m_pidlDesktop);<br> end;<br>{$R+}<br>end;<br><br>function SHNotify_UnRegister: Bool;<br>begin<br> Result := False;<br> if Boolean(m_hSHNotify) then<br> //取消系统消息监视,同时释放桌面的Pidl<br> if Boolean(SHChangeNotifyDeregister(m_hSHNotify)) then<br> begin<br>{$R-}<br> m_hSHNotify := 0;<br> CoTaskMemFree(m_pidlDesktop);<br> Result := True;<br>{$R-}<br> end;<br>end;<br><br>procedure TForm1.WMShellReg(var Message: TMessage); //系统消息处理函数<br>var<br> strPath1, strPath2: string;<br> charPath: array[0..259] of char;<br> pidlItem: PSHNOTIFYSTRUCT;<br>begin<br> pidlItem := PSHNOTIFYSTRUCT(Message.wParam);<br> //获得系统消息相关得路径<br> SHGetPathFromIDList(pidlItem.dwItem1, charPath);<br> strPath1 := charPath;<br> SHGetPathFromIDList(pidlItem.dwItem2, charPath);<br> strPath2 := charPath;<br><br> Memo1.Lines.Add(SHEventName(strPath1, strPath2, Message.lParam) + chr(13) + chr(10));<br> Application.ProcessMessages;<br>end;<br><br>procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction);<br>begin<br> //在程序退出的同时删除监视<br> if Boolean(m_pidlDesktop) then<br> SHNotify_UnRegister;<br>end;<br><br>procedure TForm1.Button1Click(Sender: TObject); //Button1的Click消息<br>begin<br> m_hSHNotify := 0;<br> if SHNotify_Register(Form1.Handle) then<br> begin //注册Shell监视<br> ShowMessage('Shelling...');<br> Button1.Enabled := False;<br> end<br> else<br> ShowMessage('Shell Error');<br>end;<br><br>procedure TForm1.FormCreate(Sender: TObject);<br>begin<br> Button1.Caption := 'Go!';<br>end;<br><br>end.