Tracing which process that has opened a particular file
From kernel mode in Windows I'm able to intercept and monitor virtually all actions performed on a particular disk. When a file is opened for any purpose I get an event. Now I want to trace which application that opened it. I think this should be possible but don't know how. I'm using the standard file management functions in Windows Win32 API. Thanks in advance. /Robert Just use Win32 N.API to get the pid from the File handle. It's a FAQ for 15 years... Sysinternals Filemon (free) does this, and better yet they describe how they did it: For the Windows 9x driver, the heart of FileMon is in