I am looking for a gratis Windows program which will let me selected from a list of running processes and press start/stop and record every file which it accesses in between.

I specifically do not want something that can only show me which files a process currently has open, as that will be too fleeting. Start; record; stop.

1 Answer 1


I would recommend Process Monitor from SysInternals to do so. It's a general purpose monitoring tool for Windows that can capture events from all programs on the system and show a log of them, incluiding filtering capabilities and other features.

While it's far more advanced than your needs, it certainly can do what you want after configuring the right filters. About your requirements, it's:

  • Gratis (not open source though).
  • Runs on all Windows versions.
  • Can monitor all kind of events, but has built-in filters to restrict to file system activity.
  • Can filter per process and per file open/close operation.
  • Can pause/resume capturing of events.


As requested in comments, as an example of the desired functionality, I've setup a filter on the firefox.exe process and added the CreateFile and CloseFile operations, so that I watch what files does my browser touches, in real-time. In the main window, the filter icon gives access to this filter options, and also to a button where you can pause capturing of events or resume them.

You can also see the operation performed (open/close a file in this case) and a detail with which file was opened, the time the event happened and what level of access was requested. It also displays failed attempts to open files and why it failed (those can be filtered out too if not wanted). Finally, the menu has an option to save the captured data into a file of various formats for further processing and posterior reloading.

Process Monitor main windows with file event filter

Configuration of filters

  • Wow! I already looked at it, and totally missed the ability to make a log. Can you elaborate, please, and I will award the answer
    – Mawg
    Commented Feb 9, 2018 at 7:25
  • @Mawg Give me a while and I'll update with some more details on how to do this.
    – Alejandro
    Commented Feb 9, 2018 at 15:36
  • 1
    @Mawg Done, hope it better explains it now :)
    – Alejandro
    Commented Feb 10, 2018 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.