Files being “moved” is a human concept for a file being created at a new location and then being deleted at the source. These are two distinct operations on the file system and as such is incredibly difficult to detect and classify. To be reliable you would need to ensure the file at the new location is in fact the same file. Since the software does not read the files on your disk it cannot determine this once the source file is deleted. Unless you index the entire drive’s contents and keep that up to date, these will always appear as new and delete events. Using the file name is not a good enough indication that it’s the same file. Furthermore, if a file moves out of a directory into an unmonitored location, it will show as a delete with no corresponding new event which will cause some confusion. Linking the two events involves a lot of assumptions when a user could also legitimately copy a file then return to the source and delete it.

From Microsoft’s documentation on file system events: “Common file system operations might raise more than one event. For example, when a file is moved from one directory to another, several OnChanged and some OnCreated and OnDeleted events might be raised. Moving a file is a complex operation that consists of multiple simple operations, therefore raising multiple events.”. Our implementation based on these assumptions with normalization so it makes more sense to humans, unfortunately “move” detection would make things overly complex and slow.