Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

See what files/registry keys are being accessed by application in Windows

How do I see what files/registry keys are being accessed by my application in Windows?

like image 504
Egor Pavlikhin Avatar asked Oct 02 '09 13:10

Egor Pavlikhin


People also ask

How do you see what files a program accesses?

You can use Process Explorer's handle viewer ( View->Lower Pane View->Handles ) to see all of the files a process has open on a Windows machine. Show activity on this post. As another answer suggests process explorer will show you currently open file handles for a process.

How do I monitor my registry activity?

Regshot is very useful tool for monitoring changes in your registry. Besides showing the current state of your Windows registry, it allows you to take a screenshot of it and save it for later comparison. Regshot is an open-source tool.

How do I check Windows registry logs?

Launch Event Viewer, and browse to Event Viewer > Windows Logs > Security. You should see “Audit Success” events recording the date and time of your tweaks, and clicking these displays the name of the Registry key accessed, and the process responsible for the edit.

What does the Windows registry keep track of?

The registry or Windows registry is a database of information, settings, options, and other values for software and hardware installed on all versions of Microsoft Windows operating systems. When a program is installed, a new subkey is created in the registry.


3 Answers

Check out Process Monitor at

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

like image 120
DexTer Avatar answered Sep 22 '22 21:09

DexTer


Microsoft Process Monitor is better at this job. I've tried other tools but they are not as good. And MS is most trustworthy in this case, since it is made by the OS developer anyway

like image 45
user3513890 Avatar answered Sep 25 '22 21:09

user3513890


I haven't tried it myself but someone should try Regmon and maybe post how it goes.

like image 34
Paul Avatar answered Sep 25 '22 21:09

Paul