How do I find out what files a process is writing to?

Question

I would like to watch a process on my system, to see what files it writes to. Is there a way of doing that?

I am on a Windows 7 machine.

Answer 1

How do I find out what files a process is writing to?

You can use Process Monitor

It monitors file system, registry, process and thread activity in real time.

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.

Download link http://download.sysinternals.com/files/ProcessMonitor.zip

Source Windows Sysinternals Process Monitor v3.1

Answer 2

You can use process utilities for your usage. Where Windows itself gives several utilities to monitor the thread and I/O operations. Check Sysinternals Process Utilities link for further details.