Where are lists of all files recently opened by a process?

Question

If I remeber correctly somewhere windows has an utility to show all opened files by processes and all recently modified file (without having to make a normal hard disk search)

Maybe in the administrative tool?

Answer 1

You're talking about several completely separate lists.

Currently opened files can be listed by ProcExp, handle, OpenedFilesView and several other tools which show open handles held by processes.

Recently modified files can be found in the Security log in Event Viewer (eventvwr.msc). However, you will only see those files which you manually enable auditing on them (under Properties → Security → Advanced), since it's disabled by default.

On NTFS, system programs can access the change journal (aka USN journal; see MSDN), which logs all volume changes including file modifications. The only userspace tool that I know of which can display the entries is fsutil.

Answer 2

There is no built-in way to see open handles, but you can see a list of in-use files and folders and what process has them open with Unlocker (as well as close, copy, delete, etc. them).

You can see a list of file and folder access with Windows Security Auditing ^[XP][7], which is included with Windows 2000 and up.