How do i determine which files are created or manipulated by a specific process programatically in c# windows OS

Question

Im coding an utility, which has to keep track of an installation.

What directories and files does this installation create on my computer.

The language is c# .net, the OS is windows.

So far iv'e used FileWatcher, which is a step on the way, but there is a LOT of OS noise that you have to clean up, and it makes the end result, a textfile with the filesystem alterations, and prone to error, which makes it unusable.

I've even filtered it so that only the events of the user (BUILTINAdministrators) which runs the installation is being tracked, but still there is a lot of noise.

.
.
.

owner = (new FileInfo(e.FullPath).GetAccessControl().GetOwner(typeof(SecurityIdentifier)).Translate(typeof(NTAccount)) as NTAccount).Value;

if (owner.Contains("BUILTIN\" + "Administratorer"))
   {
      eventList.Add(">" + e.FullPath + "<" + e.ChangeType + ":" + owner);
   }
.
.
.

Ive also tried to use the output of "handle64.exe -p processname.exe" from microsoft, but it only takes a snapshot, and is not able to keep running during an installation.

Does anybody have any idea about how to go about it in c# or if it is even possible.

Thankyou very much for your time and effort

question from:https://stackoverflow.com/questions/66059844/how-do-i-determine-which-files-are-created-or-manipulated-by-a-specific-process

Answer 1

You will want to use windows api functions to determine what processes have handles to the files your looking for specifically NtQuerySystemInformation api function to query for all handles this can be achieved with P/Invoke.