Is there any application that will check which files a running program reads, modifies etc. and can present me with a list of these?

  • What operating system?
    – Paul R
    May 22 '10 at 18:49
  • XP, sorry forgot to mention
    – jeff johanson
    May 22 '10 at 18:49

For Windows, look at two Sysinternals tools (since acquired by Microsoft):

If [ProcessExplorer] is in handle mode you'll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you'll see the DLLs and memory-mapped files that the process has loaded.

  • Process Monitor: trace all file system accesses by a process (or path, or...)

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

  • handle is another Sysinternals tool, similar to Process Explorer in that it lists a processes file handles, but it's a console app, as opposed to the other two.
  • can they be used programmatically?
    – Geo
    May 22 '10 at 18:53
  • @Geo: no, they can't. Is that what you're looking for? May 22 '10 at 18:55
  • @Geo - see my edit - you could use handle programmatically, if you wished. May 22 '10 at 19:01

It depends on what OS you're using, but BSD-like OS's such as Mac OS X have fs_usage.


On unix platforms you can use lsof | grep <pid> OR lsof -p <pid> to view all files open by a particular process.However it does not list you which files are being read or written. However a script can be made to compute checksums of the files to find out if it is being written or not.

  • oops just saw u meant on windoze!
    – Inv3r53
    May 22 '10 at 18:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy