Monitor files accessed by windows

Question

Is there a way to hook into the windows API to view all files accessed by the operating system?

Answer 1

No, there is no user-mode API to do this.

If you really need this, you have to write a pseudo-device driver that becomes a part of the I/O stack in the kernel, which is definitely not for the faint of heart. This is how Process Monitor works; it extracts code from its own EXE and dynamically loads it as a device driver (of course, this needs admin permissions).