I remember that i made à Vbscript like that , you can take a look at this code
I hope that can help you and give you more idea.
Option Explicit
Dim fso,Message,Message2,Msg,intInterval,strDrive,strFolder,strComputer,objWMIService,strQuery
Dim colEvents,objEvent,objTargetInst,objPrevInst,objProperty,ws,LOG_FILE_PATH,LogFile,Chemin,MonTableau
Set fso = CreateObject("Scripting.FileSystemObject")
Set ws = CreateObject("WScript.Shell")
strComputer = "."
Chemin = Parcourir_Dossier()
MonTableau = Split(Chemin,"")
LogFile = MonTableau(UBound(MonTableau)) & ".log"
LOG_FILE_Path = ws.ExpandEnvironmentStrings("%AppData%") & "" & LogFile
intInterval = "2"
'****************************************************************************************************
Function Parcourir_Dossier()
Dim ws,objFolder,Copyright
Copyright = "[ ? Hackoo ? 2014 ]"
Set ws = CreateObject("Shell.Application")
Set objFolder = ws.BrowseForFolder(0,"Choose the folder to watch for "_
& Copyright,1,"c:Programs")
If objFolder Is Nothing Then
Wscript.Quit
End If
Parcourir_Dossier = objFolder.self.path
end Function
'****************************************************************************************************
Chemin = Split(fso.GetAbsolutePathName(Chemin),":")
strDrive = Chemin(0) & ":"
strFolder = Replace(Chemin(1), "", "")
If Right(strFolder, 2) <> "" Then strFolder = strFolder & ""
'Connexion au WMI
Set objWMIService = GetObject( "winmgmts:" &_
"{impersonationLevel=impersonate}!" &_
strComputer & "
ootcimv2" )
'La cha?ne de la requête
strQuery = _
"Select * From __InstanceOperationEvent" _
& " Within " & intInterval _
& " Where Targetinstance Isa 'CIM_DataFile'" _
& " And TargetInstance.Drive='" & strDrive & "'"_
& " And TargetInstance.path='" & strFolder & "'"
'Exécutez la requête
Set colEvents = _
objWMIService.ExecNotificationQuery(strQuery)
Do
Set objEvent = colEvents.NextEvent()
Set objTargetInst = objEvent.TargetInstance
Select Case objEvent.path_.Class
'Si c'est le cas de la création de fichier ou d'un événement de suppression et afficher
'juste le nom du fichier
Case "__InstanceCreationEvent"
Message = DblQuote(objTargetInst.Name) & " is created !"
Message2 = String(10,"*") & Now & String(10,"*") & vbCrLf & Message & vbCrLf & String(70,"*")
Call Log(LOG_FILE_Path,Message2)
'MsgBox Message2,VbInformation,Message
Case "__InstanceDeletionEvent"
Message = DblQuote(objTargetInst.Name) & " is deleted !"
Message2 = String(10,"*") & Now & String(10,"*") & vbCrLf & Message & vbCrLf & String(70,"*")
Call Log(LOG_FILE_Path,Message2)
'MsgBox Message2,VbInformation,Message
'Si c'est le cas de la modification du fichier,comparer les valeurs de propriété de la cible et de l'instance précédente
'et afficher les propriétés qui ont été changé comme la taille et LastModified
Case "__InstanceModificationEvent"
Set objPrevInst = objEvent.PreviousInstance
For Each objProperty In objTargetInst.Properties_
If objProperty.Value <> _
objPrevInst.Properties_(objProperty.Name) Then
Message = "modified file : " & vbCrLf &_
objTargetInst.Name & vbCrLf &_
"Property : "_
& objProperty.Name & vbCrLf &_
"Last Value : "_
& objPrevInst.Properties_(objProperty.Name) & vbCrLf &_
"New value : " _
& objProperty.Value
Message2 = String(10,"*") & Now & String(10,"*") & vbCrLf & Message & vbCrLf & String(70,"*")
Call Log(LOG_FILE_Path,Message2)
'MsgBox Message,64,DblQuote(objTargetInst.Name)
End If
Next
End Select
Loop
'**********************************************************************************************
Function DblQuote(Str)
DblQuote = Chr(34) & Str & Chr(34)
End Function
'**********************************************************************************************
Sub Log(strLogFileChemin,strLogContent)
Const APPEND = 8
Dim objFso,objLogFile
Set objFso = CreateObject("Scripting.FileSystemObject")
If Not objFso.FileExists(strLogFileChemin) Then objFso.CreateTextFile(strLogFileChemin, True).Close
Set objLogFile = objFso.OpenTextFile(strLogFileChemin,APPEND)
objLogFile.WriteLine strLogContent
objLogFile.Close
End Sub
'**********************************************************************************************