11

Is there a way to detect what process is changing a file on Windows 7?

I know procmon is a great tool but couldn't figure it out how to do it or even if it's possible.

The problem is that I have a file that is changed by some application and I want to find out which one.

1
  • Why can't you use the filter in ProcMon (just type in the name of the file)?
    – Dave
    Dec 19, 2012 at 12:27

1 Answer 1

15

Both procexp and procmon are good for this. If the process holds a handle to the file in question then just run procexp and choose "Find Handle or DLL" from the Find menu then type in part of the file name you're searching for.

Alternatively (and as mentioned in the comments to the question), to use procmon to find, for example, a file called readme.txt open the filter dialog and set the filter as so:

Process monitor filter screen capture

Then press the Add button. Make sure there are no other processes that are excluded that might be touching your file.

Then start capturing events and sit back and wait.

4
  • How can you tell that an event in procmon is a file modification event? I can see place where the file is opened and closed, but I can't see events that are clearly modifications to the file. Jan 29, 2013 at 2:15
  • In the README.txt case there appears to be a WriteFile operation. I don't think it's always that easy though as it will depend on how the application deals with writing - ie does it cache stuff or save writes until later etc etc. There's also a QueryBasicInformationFile operation which has LastAccess and LastWrite times.
    – shunty
    Jan 29, 2013 at 10:52
  • @shunty: Ahh, there was so much file reading going on that the WriteFile operations were hidden in the noise. I captured the whole install process from beginning to end. So it doesn't matter if there was any caching or buffering, if a file was written to the event should be in there. Jan 29, 2013 at 18:27
  • Thank you, @shunty May 10, 2021 at 17:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.