How would I determine what program/process created a file?

delphi package - easy access to shell apis

How would I determine what program/process created a file?

Postby Fatmoe » Tue Aug 29, 2006 7:54 pm

How can I determine what program/process created a file, after a event has been fired? i.e after the modified, created, rename, etc events.
Fatmoe
 
Posts: 1
Joined: Tue Aug 29, 2006 7:50 pm

Postby madshi » Wed Aug 30, 2006 7:11 am

That's not really possible in any easy way.

What you could do is to enumerate all open file handles of all processes to check which process has a handle open to the file you're interested in. This would be a VERY brute force approach, though, and I don't recommend to use this, unless you absolutely ultimately *must* know it.
madshi
Site Admin
 
Posts: 9268
Joined: Sun Mar 21, 2004 5:25 pm


Return to madShell

Who is online

Users browsing this forum: No registered users and 1 guest