intInterval = "2"
strDrive = "C:" 
strFolder = "\\tools\\"
strComputer = "." 

Set objWMIService = GetObject( "winmgmts:" &_ 
    "{impersonationLevel=impersonate}!\\" &_ 
    strComputer & "\root\cimv2" )

strQuery =  _
    "Select * From __InstanceOperationEvent" _
    & " Within " & intInterval _
    & " Where Targetinstance Isa 'CIM_DataFile'" _
    & " And TargetInstance.Drive='" & strDrive & "'"_
    & " And TargetInstance.Path='" & strFolder & "'"

Set colEvents = _
    objWMIService. ExecNotificationQuery (strQuery) 

Do 
    
    Set objEvent = colEvents.NextEvent()
    Set objTargetInst = objEvent.TargetInstance
    
    Select Case objEvent.Path_.Class 
        
        Case "__InstanceCreationEvent" 
            WScript.Echo "Created: " & objTargetInst.Name 

        Case "__InstanceDeletionEvent" 
            WScript.Echo "Deleted: " & objTargetInst.Name 
        
        Case "__InstanceModificationEvent" 
        
            Set objPrevInst = objEvent.PreviousInstance
        
            For Each objProperty In objTargetInst.Properties_
                If objProperty.Value <> _
                objPrevInst.Properties_(objProperty.Name) Then
                    WScript.Echo "Changed:        " _
                        & objTargetInst.Name
                    WScript.Echo "Property:       " _
                        & objProperty.Name
                    WScript.Echo "Previous value: " _
                        & objPrevInst.Properties_(objProperty.Name)
                    WScript.Echo "New value:      " _
                        & objProperty.Value
                    WScript.Echo
                End If            
            Next

    End Select 

Loop