Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to detect what process is changing a file on Windows 7?

I know procmon is a great tool but couldn't figure it out how to do it or even if it's possible.

The problem is that I have a file that is changed by some application and I want to find out which one.

share|improve this question
Why can't you use the filter in ProcMon (just type in the name of the file)? – Dave Dec 19 '12 at 12:27
up vote 7 down vote accepted

Both procexp and procmon are good for this. If the process holds a handle to the file in question then just run procexp and choose "Find Handle or DLL" from the Find menu then type in part of the file name you're searching for.

Alternatively (and as mentioned in the comments to the question), to use procmon to find, for example, a file called readme.txt open the filter dialog and set the filter as so:

Process monitor filter screen capture

Then press the Add button. Make sure there are no other processes that are excluded that might be touching your file.

Then start capturing events and sit back and wait.

share|improve this answer
Thanks a bunch @shunty :) – RaduM Dec 19 '12 at 16:02
How can you tell that an event in procmon is a file modification event? I can see place where the file is opened and closed, but I can't see events that are clearly modifications to the file. – Omnifarious Jan 29 '13 at 2:15
In the README.txt case there appears to be a WriteFile operation. I don't think it's always that easy though as it will depend on how the application deals with writing - ie does it cache stuff or save writes until later etc etc. There's also a QueryBasicInformationFile operation which has LastAccess and LastWrite times. – shunty Jan 29 '13 at 10:52
@shunty: Ahh, there was so much file reading going on that the WriteFile operations were hidden in the noise. I captured the whole install process from beginning to end. So it doesn't matter if there was any caching or buffering, if a file was written to the event should be in there. – Omnifarious Jan 29 '13 at 18:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .