How to control the process of IO activity using C #?

Question

Using FileSystemWatcher, we can track the IO activity of a particular file system, but still know which of the running processes causes IO?

More specifically, suppose that the running process, abc.exe, creates a text.txt file on drive D. We can track that a file called text.txt was created on drive D using FileSystemWatcher, but we can programmatically determine that the process with does abc.exe create this particular file in drive D?

Answer 1

handle.exe from SysInternals is a command line tool that allows programmatic access to which program a particular file or directory is opened.

 C:\>handle.exe c:\Windows\system32\stdole2.tlb 

Produces this conclusion:

 Handle v3.42 Copyright (C) 1997-2008 Mark Russinovich Sysinternals - www.sysinternals.com devenv.exe pid: 5240 184: C:\Windows\System32\stdole2.tlb Ssms.exe pid: 5000 1F4: C:\Windows\System32\stdole2.tlb 

which can be analyzed programmatically.

http://technet.microsoft.com/en-us/sysinternals/bb896655.aspx

Answer 2

No, It is Immpossible. FSW is at a very low level in the file system stack. He can only say that the file system is becoming modified, it does not know who. It is very designed, it can be a process that sits halfway around the world, using a VPN connection over the Internet to use file sharing. There is no reasonable alternative for your request.

Answer 3

I would recommend SysInternals utilities for this, not for my own use.

http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx