Check which files a program uses

Question

Is there any application that will check which files a running program reads, modifies etc. and can present me with a list of these?

Answer 1

For Windows, look at two Sysinternals tools (since acquired by Microsoft):

• Process Explorer: what file handles are in use at any given time.

If [ProcessExplorer] is in handle mode you'll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you'll see the DLLs and memory-mapped files that the process has loaded.

• Process Monitor: trace all file system accesses by a process (or path, or...)

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

• handle is another Sysinternals tool, similar to Process Explorer in that it lists a processes file handles, but it's a console app, as opposed to the other two.

Answer 2

On unix platforms you can use lsof | grep <pid> OR lsof -p <pid> to view all files open by a particular process.However it does not list you which files are being read or written. However a script can be made to compute checksums of the files to find out if it is being written or not.

Answer 3

It depends on what OS you're using, but BSD-like OS's such as Mac OS X have fs_usage.