Thread: Extended file information

Is there a way to determine what files are being accessed by running processes on a system (when enumerating them via EnumProcesses)? I want to see how many, and which ones are being accessed by the running programs.

All I need is a function or website to start. I have been unable to find anything that could help me so far. Is this even possible, I imagine that it is since opening files creates a handle in windows so there must be a way to access that list? Or at least access the different file handle lists of each program?

There is no simple documented function that you can call, but have a look at the following links.
http://www.sysinternals.com/ntw2k/source/filemon.shtml
http://www.codeguru.com/Cpp/W-P/file...cle.php/c1287/

Thanks, those will be a great help. I'll have to read over them a bit later though... damn work! lol