A file is being deleted seemingly randomly throughout the day. The vendor of the software whose file is being deleted says that another piece of software installed on the computer is deleting it, while the other software's vendor says the opposite.

I've tried using Process Monitor so I can pinpoint exactly what's deleting it, but even when filtered specifically to that file, createfile operations are being triggered a few times a second, and I can't filter it to deletions specifically.

Is there a tool or script I can use to specifically monitor deletion attempts on a single file?

  • temporarily set the file to read only, then within procmon you should see and access denied with the process name. – user33788 Jun 8 '10 at 20:22
  • Unfortunately, I'm not sure that's feasible, the deletions are far enough between that I can't keep the service offline without a lot of work setting up a backup on another system, but short enough between to keep us busy fixing things every time it happens. – Jordan Milne Jun 9 '10 at 1:33

If you're using Process Monitor, watch for the operation SetDispositionInformationFile, Result SUCCESS, detail Delete: True on whatever path that's being deleted.

  • There is an additional event: SetDispositionInformationEx that denotes file deletion... – gavenkoa Nov 11 '20 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.