How File Tamper Detection Works

Two Approaches to "Noticing" File Changes

There are broadly two ways to notice that an important file has been altered or deleted.

• Periodic comparison (polling): Record a file's hash or timestamp at regular intervals and compare it against the previous value. Simple to implement, but there's a lag between the change and detection, and shortening the interval increases CPU load.
• Event notification (real-time monitoring): Use an OS-provided mechanism that notifies you the moment a file changes. Detection happens with almost no lag and low CPU overhead.

ShieldGuard EDR uses the latter approach, real-time monitoring.

The Windows Mechanism: ReadDirectoryChangesW

Windows provides an API called ReadDirectoryChangesW that notifies your application at the OS level whenever a file is created, modified, deleted, or renamed within a directory you specify. An application simply calls this API to register "please notify me of changes in this folder," and the OS delivers an event when a change actually occurs.

The advantage of this approach is that the application never has to repeatedly poll the file system. It barely uses any CPU when nothing changes, and detects changes with virtually no delay when they do.

"Detection" and "Prevention" Are Different Things

The important point here is that an API like ReadDirectoryChangesW is a mechanism for knowing that a change happened — not a mechanism for stopping the change itself. Preventing tampering before it happens requires intervention at the file system driver level (e.g. a minifilter driver, which requires a signed kernel driver).

ShieldGuard EDR deliberately doesn't step into that "prevention" territory — it's focused on detection and alerting. Even its tamper-detection mechanism (detecting when the agent itself is stopped, via a watchdog) is explicitly documented as best-effort, not a guarantee against forced termination by an attacker.

How to Think About This in Practice

It's practical to think of file tamper detection not as "the last line of defense," but as "a way to notice something happened, quickly." For your most important files, we recommend pairing tamper detection with generational backups kept separately, so you can still recover even if a file is genuinely tampered with or encrypted.