Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If I remeber correctly somewhere windows has an utility to show all opened files by processes and all recently modified file (without having to make a normal hard disk search)

Maybe in the administrative tool?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

You're talking about several completely separate lists.

Currently opened files can be listed by ProcExp, handle, OpenedFilesView and several other tools which show open handles held by processes.

Recently modified files can be found in the Security log in Event Viewer (eventvwr.msc). However, you will only see those files which you manually enable auditing on them (under Properties → Security → Advanced), since it's disabled by default.

On NTFS, system programs can access the change journal (aka USN journal; see MSDN), which logs all volume changes including file modifications. The only userspace tool that I know of which can display the entries is fsutil.

share|improve this answer
Task MAnager->Performance->Resource monitor->disk too –  dynamic Feb 12 '12 at 21:19
Or that. (I'm stuck with Win XP here.) –  grawity Feb 12 '12 at 21:20

There is no built-in way to see open handles, but you can see a list of in-use files and folders and what process has them open with Unlocker (as well as close, copy, delete, etc. them).

You can see a list of file and folder access with Windows Security Auditing [XP][7], which is included with Windows 2000 and up.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.