File Watcher - get the name of the process that created a file on Windows?
Is there a good way to get the name of the process that created the file on Windows?
I have a directory on Windows 2000 Server
C: \ WINNT \ Temp which is filled with files like:
70618199
21834082
They are always 121.201 KB in size.
Can you programmatically capture the name of the program or the name of the service that deletes files at this location?
ADDITIONAL INFORMATION:
I have done some more research on this. I renamed the TIFF file and was able to open it.
This machine works as a document search tool through a custom ASP.NET written application. The machine contains about 50,000 TIFF documents on the E: \ drive. This machine also runs SQL Server 2000 with full-text indexing. Full-text indexing doesn't affect TIFF in any way - but it shouldn't, because it's SQL right? But FTS does require the Indexing Service to be enabled. The weird thing is that this TIFF appears to be the largest one served by the web server. Is IIS or Indexing Service C: \ WINNT \ Temp using for some kind of caching? Thoughts?
RESOLUTION (maybe?)
Looks like Microsoft Indexing Service.
When I close it, none of these files are created in WINNT \ Temp.
It seems to grab the largest file found and copy it to WINNT \ Temp. This is strange. When you are dealing with a 100MB + TIFF file, it can run out of disk space. Very annoying.
I guess I'll just close the "Web" branch of my Indexing Services.
source to share
There is always a Process monitor that replaces FileMon, which will tell you which process is accessing the files in question.
source to share
If you want something similar to a fuser for windows you can check out Process Explorer
It won't let you watch the file, but you can see if the currently running processes will access this temp directory and create similar named temp files.
source to share
The only way I have found this from .NET is to launch the Sysinternal Command-Line Handle App and pass the file enter the name and read the console output to try to catch the original application with the file descriptor open.
Otherwise the utilities that others have talked about will work fine.
source to share
\ RECYCLER \ S-1-5-21-1482476501-1644491937-682003330-1013 \ service.exe
This is the Recycler virus. He created a hidden folder called "Recycler". On all disk partitions, I was unable to remove them from Windows Safe Mode. Norton, AVG Kaspersky could not detect or remove it.
I turn off System Restore by restarting my computer using the boot drive, going to the command prompt and deleting the "Recycler" folder from all drives. using command rmdir / sc: \ recycler
This is the only one that worked for me on Windows XP.