1

There are several threads on SO that describe how to check which application creates a file with tools like Sysinternals process monitor. Is something like this possible programmatically from .net?

Background: My program has to remote-control a proprietary third party application using its automation interface, and one of the functions I need from this application has a bug where it creates a bunch of temporary files in %TEMP% that are called tmpXXXX.tmp (the same as .net's Path.GetTempFileName() does) but does not delete them. This causes the C drive to become full over time, eventually failing the application. I already filed a bug to the manufacturer, but we need a temporary workaround for the time being, so I thought of putting a FileSystemWatcher on %TEMP% that watches tmp*.tmp, collects these files, and after the operation on the third-party application finishes, deletes them. But this is risky as another application might also write files with the same file name pattern to %TEMP% so I only want to delete those created by NastyBuggyThirdPartyApplication.exe.

Is this anyhow possible?

rabejens
  • 7,594
  • 11
  • 56
  • 104
  • I know how you can tell which has what file open - but not if its now closed...... – BugFinder Aug 19 '16 at 08:46
  • possible wrokaround: If you can run the program under a custom user account, then you can simply check the owner of the files – HugoRune Aug 19 '16 at 08:51
  • There is nothing inherent in a file that contains the information you're seeking. You either have to "be there" when the file is created and monitor the application(s) in question, or you have to resort to trickery such as the above mentioned user account. – Lasse V. Karlsen Aug 19 '16 at 08:54
  • See similar: http://stackoverflow.com/questions/428774/file-watcher-get-the-process-name-that-created-a-file-in-windows and you can use Process Monitor, set a filter for the directory and process you want. Then export the log using command line and process the file list. – Dave Williams Aug 19 '16 at 08:57

2 Answers2

0

This kind of things is possible, but maybe a bit tricky.

  1. To know who created the file, look at the user that owns it. Therefore you might need to create a specific user, and that application will run under this specific user. In order to do that, you need to create a small application that will start your buggy app by impersonating another user, so anything done within the app will be under this user so as file creating...

  2. I don't know how to monitor and get triggered when a file is created, but nothing can prevent you from setting a timer that wakes up every five or ten minutes, then checks if any file in the directory is owned by the application user and closed, so it deletes it.

  3. Maybe if they react fast for this bug fixing, you won't need your app very long time. So another solution, if possible might just to change the Temp folder into another drive, which has lots of space...

Martin Verjans
  • 4,675
  • 1
  • 21
  • 48
  • I am currently going for option 3 for the time being because creating another user is not so simple on this system. This is a system controlling a bunch of measuring equipment and needs a very special configuration. Users and groups are handled by a domain and I don't want to risk changing anything there. However, I saw a pattern behind the files that only this special application uses since the files are in its own proprietary format. So I just check if the files contain specific things at specific positions to be able to tell which to delete. – rabejens Aug 19 '16 at 08:56
0

One solution is that you use a FileWatcher to automatically delete all the files but before deleting you should check if the file is not currently locked or used by other process, for example the Sysinternal Suite has a tool called handle.exe that can do this. Use it from the command line:

handle.exe -a

You can invoke this from a c# program (there might be some performance issues though)

So what you would do is when a file is created you verify if it is in use or locked (for example u can use the code provided in Is there a way to check if a file is in use?) and then delete it.

Most of the time when an app is using a temp file it will lock it to prevent just what you fear, that you might delete files from other processes.

As far as I can tell there is no sure way to identify which process created a specific file.

Community
  • 1
  • 1
Freddy Ayala
  • 49
  • 4