Hello, dear harrowdale and habrovany!
There is a need in the program that analyzes these to her folder on the user's actions and writes everything in a journal.
The idea has partly become a reality. I wrote in C# because I'm so comfortable. Figured out FileSystemWatcher'ohms. When you create the file looking for the path of the SID of the owner of the file and everything seems fine — found out who created the file recorded in log.
But there was a catch. How to find out SID removed or recorded in the file?