Search code examples
c++winapifileprocess-management

Tracing which process that has opened a particular file

From kernel mode in Windows I'm able to intercept and monitor virtually all actions performed on a particular disk. When a file is opened for any purpose I get an event.

Now I want to trace which application that opened it. I think this should be possible but don't know how.

I'm using the standard file management functions in Windows Win32 API.

Thanks in advance.

/Robert

Solution

  • Just use Win32 N.API to get the pid from the File handle. It's a FAQ for 15 years...