Detect what file a process is changing a on Windows

Question

Is there a way to detect what file a process is changing in Windows?

I created a process - my_python_script.exe (python script I have compiled), and I would like to know what files the process changes using Windows tools such as procmon.exe or process explorer.

In this post: Detect what process is changing a file on Windows I found the exact opposite (what processes change a specific file).

But I would like to know how to find all the files a specific process is changing.

Thank you.

Answer 1

I would like to know how to find all the files a specific process is changing.

You can use procmon for this.

1. Deselect (uncheck) "File > Capture Events".

2. Clear the currently displayed events Edit > Clear Display

3. Configure filters:

   Filter > Filter... menu item. This will display the "Process Monitor Filter" dialog.

4. Set a new filter by setting the "Display entries matching those conditions" fields to, for example:

   Process (drop down) > contains (drop down) notepad++ (edit box)

   Operation (drop down) > contains (drop down) fastio (edit box)

5. File > Capture Events

Here is an example showing Notepad++ opening the file test.cmd

Change the fastio filter to be more explicit if you want to reduce the number ofevent shown.

Answer 2

It is easy to do, you already know the program you need to use, it is "Process Monitor"(procmon.exe), you just need to use different filters.

First you need to set the filter to include the program you want to monitor by either set:

PIDis$pidthenInclude

• $pid is a placeholder for the actual pid, i.e. 7552

or: Process Nameis$namethenInclude

• $name is a placeholder for the actual process name, i.e. explorer.exe

You can get process name and pid through Task Manager(taskmgr.exe), by left clicking "More details" then right click on resource values bar and check "PID" and "Process Name".

Either of the about two options will work and they have the exact same effect, they will make procmon display only activities of the process, the difference is PID is variable and may change every time the process launches, but it may be easier to type. The process name may be harder to type but is invariable (unless you rename the executable).

Then you need to set the filter OperationisWriteFilethenInclude to display the file changes made by the process. WriteFile is the operation recorded when a file is modified.

Then click Apply and then OK to make the filter take its effect.