How would I determine what program/process created a file?

delphi package - easy access to shell apis
Post Reply
Fatmoe
Posts: 1
Joined: Tue Aug 29, 2006 7:50 pm

How would I determine what program/process created a file?

Post by Fatmoe »

How can I determine what program/process created a file, after a event has been fired? i.e after the modified, created, rename, etc events.
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

That's not really possible in any easy way.

What you could do is to enumerate all open file handles of all processes to check which process has a handle open to the file you're interested in. This would be a VERY brute force approach, though, and I don't recommend to use this, unless you absolutely ultimately *must* know it.
Post Reply