Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How can I find all the files that a Windows executable has opened or access when it is running?

Tags:

file

windows

I want to understand and track what an executable program/application/process is doing my computer. How can I find all the files (like ouput files, log files, etc.) that it has opened or is accessing when it is running?

like image 581
Tom Silverman Avatar asked Jan 23 '13 12:01

Tom Silverman


People also ask

How do you see what files a program is accessing?

You can use Process Explorer's handle viewer ( View->Lower Pane View->Handles ) to see all of the files a process has open on a Windows machine. Save this answer. Show activity on this post. As another answer suggests process explorer will show you currently open file handles for a process.

How do I see a list of open files in Windows?

Step 1: Go to the Start menu, press the Windows key, and type Resource monitor in the search box. Now, select Resource monitor and click open. Another technique is to run task manager, select the performance tab and click Open Resource Monitor.


2 Answers

Process Explorer has a second pane, showing all open handles:

enter image description here

Also Process Monitor can monitor and log all registry and file access from a process.

like image 136
Joey Avatar answered Oct 16 '22 14:10

Joey


Process Monitor sounds exactly what you are looking for.

Just find your process and it tells you in detail what the process is doing, more so than Process Explorer.

like image 2
Bali C Avatar answered Oct 16 '22 16:10

Bali C