How do you determine the last process to modify a file?

Question

I know how to get the user that last modified a file, but does Windows track the process that made the modification as well? If so, is there an API for looking that up?

Answer 1

No. It is not recorded.

You could enable Object Access Auditing on a particular folder (I wouldn't recommended using on the general file system). See this post and use with caution!

You might be able to use .NET's FileSystemWatcher class.

Answer 2

Windows does NOT track the process that modifies a file. Best you can hope for is to actively watch the file(s) you are interested in and take note when an application opens them. I've seen applications that do this (eg. Sysinternals FileMon) but do not know off the top of my head how to accomplish it.

Answer 3

If you want to determine the process that is modifying the file during the runtime of your program, you could use the Windows API or a minifilter driver to track what every process on the system is doing (similar to using Sysinternals FileMon with custom filters, as Boo pointed out), but that will apply only during the runtime of your "capture" program. Once the file is modified, however, all the traces are gone.

Answer 4

Could you use Windows security auditing to log access to the file?