How find a process which removed/moved a given file in Windows

StackOverflow https://stackoverflow.com/questions/20354463

  •  28-08-2022
  •  | 
  •  

Question

Suppose I have some files removed (or probably moved or renamed) in a Windows machine. Now I would like to find out what process removes/moves them. How can I do it?

Was it helpful?

Solution

Assuming that you need this in code, the only option is to have a filesystem filter driver intercept the requests and capture the information you need. Our CallbackFilter product lets one do this in user-mode (the driver is included).

Other options (not in code) are enable audit on the files in question and use ProcMon tool (Process Monitor by Sysinternals) to monitor the files.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top