I am using SHChangeNotifyRegister to monitor when someone copies files from the system to a USB stick. The returned value is the path of the USB drive plus the name of the file. This works fine because I know the drive letter the USB stick is mapped to.
Now I want to monitor when files are copied FROM the USB stick. Because the returned value is the TO address I don't know where the copied file has come from - (it could be another mapped drive).