How to identify files used in a program?

Page 2 of 2 FirstFirst 12

  1. Posts : 2,799
    Linux Mint 20.1 Win10Prox64
       #11

    Here's an example on how to monitor notepad++.exe
    1 - Open Procmon.exe -> crtl + E to toggle start/stop monitoring, crtl->x clear display -> crtl + L to open filter windows
    2 - Use 1,2,3 to enter the criteria
    3 - Crtl+E to start monitoring while using notepad++. Once done, crtl + E to stop

    How to identify files used in a program?-2023-05-15_235921.jpg
      My Computer


  2. Posts : 222
    Windows 10 Pro
    Thread Starter
       #12

    topgundcp said:
    Here's an example on how to monitor notepad++.exe
    1 - Open Procmon.exe -> crtl + E to toggle start/stop monitoring, crtl->x clear display -> crtl + L to open filter windows
    2 - Use 1,2,3 to enter the criteria
    3 - Crtl+E to start monitoring while using notepad++. Once done, crtl + E to stop

    How to identify files used in a program?-2023-05-15_235921.jpg
    Thank you. I'm glad it can EXclude almost 2 million events! Quick follow-up question: is it able to monitor the names and the file path of 'open'ed files?
      My Computer


  3. Posts : 1,816
    Windows 10 Pro
       #13

    Add more RAM?
      My Computers


  4. Posts : 2,799
    Linux Mint 20.1 Win10Prox64
       #14

    @bofhlusr
    I usually use this program to monitor the registry where the program set/write/delete its registry value. You probably want to look at task manager for the file name, as you can see here I am editing New Text Docunent.txt
    How to identify files used in a program?-2023-05-16_151310.jpg
      My Computer


  5. Posts : 222
    Windows 10 Pro
    Thread Starter
       #15

    topgundcp said:
    @bofhlusr
    I usually use this program to monitor the registry where the program set/write/delete its registry value. You probably want to look at task manager for the file name, as you can see here I am editing New Text Docunent.txt
    How to identify files used in a program?-2023-05-16_151310.jpg
    Notepad++ was just an example. But the program I plan to use is not simple. For example, it uses an "add-on" program that comes with about 170,000 files. I'd like to save the files opened by the main program (if any, among the 170k files) to a text file for review after I quit the main program.
      My Computer


  6. Posts : 1,914
    Windows 10 Pro (+ Windows 10 Home VMs for testing)
       #16

    bofhlusr said:
    Thank you. I downloaded and installed Process Monitor. As an example, how do I monitor "notepad.exe" and get a text record of the files opened and closed by "notepad.exe"?
    1. Run Process Monitor.

    2. Run Notepad

    3. Start Process Monitor's 'Capture'.

    4. Type a couple of letters in Notepad then stop.

    5. Stop Process Monitor's capture.

    6. Using 'Find' in Process Monitor's toolbar, look for 'notepad.exe' in the 'Process Name' column.

    7. When an entry as been found, right-click on the entry and choose 'Include 'notepad.exe''. This will set a filter excluding events not linked to 'notepad.exe':
    How to identify files used in a program?-procmon_filter_for_notepad.png

    For your own search, you've made it clear you are interested just in files... so use the 'Show File System Activity' filter in the Activity bar in the main tool bar. This will temporarily disable all activity from view except 'File System':
    How to identify files used in a program?-procmon_activity_views_new_version.png

    Hope this helps...
      My Computer


  7. Posts : 1,914
    Windows 10 Pro (+ Windows 10 Home VMs for testing)
       #17

    x509 said:
    Add more RAM?
    Far easier to use 'Filter > Drop Filtered Events'.
      My Computer


  8. Posts : 222
    Windows 10 Pro
    Thread Starter
       #18

    Post #11 and 16 solved the problem for me. Thank you.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 22:01.
Find Us




Windows 10 Forums