How do I log which process is deleting a file on Windows XP?
A file is being deleted seemingly randomly throughout the day. The vendor of the software whose file is being deleted says that another piece of software installed on the computer is deleting it, while the other software's vendor says the opposite.
I've tried using Process Monitor so I can pinpoint exactly what's deleting it, but even when filtered specifically to that file, createfile operations are being triggered a few times a second, and I can't filter it to deletions specifically.
Is there a tool or script I can use to specifically monitor deletion attempts on a single file?
If you're using Process Monitor, watch for the operation SetDispositionInformationFile
, Result SUCCESS
, detail Delete: True
on whatever path that's being deleted.