Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm having an issue with a file getting deleted seemingly randomly throughout the day. The vendor of the software whose file is getting deleete says that another piece of software installed on the computer is deleting it, while the other software's vendor says the opposite.

I've tried using Process Monitor so I can pinpoint exactly what's deleting it, but even when filtered specifically to that file, createfile operations are being triggered a few times a second, and I can't seem to filter it to deletions specifically.

Is there a tool or script I can use to specifically monitor deletion attempts on a single file?

share|improve this question
    
temporarily set the file to read only, then within procmon you should see and access denied with the process name. –  user33788 Jun 8 '10 at 20:22
    
Unfortunately, I'm not sure that's feasible, the deletions are far enough between that I can't keep the service offline without a lot of work setting up a backup on another system, but short enough between to keep us busy fixing things every time it happens. –  Jordan Milne Jun 9 '10 at 1:33
add comment

1 Answer

If you're using Process Monitor, watch for the operation SetDispositionInformationFile, Result SUCCESS, detail Delete: True on whatever path that's being deleted.

share|improve this answer
    
Thanks, I'll see how this works tomorrow. –  Jordan Milne Jun 9 '10 at 1:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.