Under Windows 7, how can I monitor all filesystem activity made by a specific process?
Goal is to identify, which and when config files of a server process get loaded.
Windows – Monitoring file system activity of a process
filesfilesystemswindowswindows 7
Best Answer
Sysinternals' Process Explorer can give you information on the current state of processes, but what you want is Process Monitor (Procmon). Start it up and then launch your process. Once the process exits, or the event you are waiting for has occurred, stop the capture. Procmon is very verbose; you will have captured hundreds of thousands, if not millions, of events, so you will need to filter on things like process name, PID, path, etc. If the process touched a file or registry key or communicated on the network, you will see it here.