1

I'm trying to get a list of files accessed by a specific process by having either its process ID or by launching it under some command line utility.

I tried xperf but the documentation is really vague and despite a day of attempts, I can't get what I need.

Is anybody aware of such utility?

Note: The list of accessed file should include also the file that have been opened and closed.

snovelli
  • 121

1 Answers1

2

I know Process Monitor 3.2 will do what you want, but it is known primarily as GUI based tool. If you type procmon /?, you get a list of command line options. My suggestion would be to export a configuration (.pmf) and use it to export a CSV or XML file for analysis.

Unfortunately, having to create a configuration file beforehand does not allow you to just type the name of the process you want to follow. You can automate writing of filters, but requires you to use PowerShell.

enter image description here

Sun
  • 6,480