3

I have an installation of a very large Windows program, and I want to understand which files are actually read while I install the program, which my specific setup.

Is there a way to monitor this and get a list of files which were read?

I looked at Process Monitor, and I can put a filter on the directory I want to monitor, but I didn't find an easy way to get a list of files which were opened in that directory.

6 Answers6

5

Filemon from sysinternals will allow you to see what files are accessed in real time. You can run filemon and then go through your program installation and monitor what files were accessed.

As Jim B has commented, Process Monitor has replaced Filemon. As a further note to the original questioner, when you filter in Process Monitor, make sure your filter is "Path" "contains" rather than "Path" "is". If you do Path is, it just shows the path you specified in the path field/column and you no longer see the actual file names. Using "contains" preserves the file names so you can see what is accessed in that directory.

David Yu
  • 1,032
  • 7
  • 14
  • 1
    Filemon was long ago replaced by process monitor http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx – Jim B Jul 20 '09 at 00:26
0

Windows (optionally) keeps access times (atimes), you can use those to get your information, however I don't have any ideas on a good, simple method to make use of them.

LapTop006
  • 6,496
  • 20
  • 26
0

You could use a snapshotting tool such as regshot.

Scott Hoffman
  • 141
  • 3
  • regshot is a nice suggestion, but it can't tell me which files have been read, only which files are added , for example after installation, and which registry entries are added. –  Jul 19 '09 at 15:21
0

If procmon is not helping you (which makes me wonder why) as an alternative you can pull out the big guns and use xperf (blog post, download) Based on event tracing for windows, this can tell you more than you ever wanted to know about what happened to what and when on a windows system.

Jim B
  • 24,081
  • 4
  • 36
  • 60
0

There is a commercial program called PA File Sight that may be easier to set up and use than Filemon. They offer a fully functional 30-day free trial.

Adam Brand
  • 6,127
  • 2
  • 30
  • 40
0

Gala,

Have you taken a look at InstallWatch?

InstallWatch is FREE and records modifications made to your PC during the installation of software, hardware, or configuration changes.

You can find it here:

http://www.epsilonsquared.com

Note: This might not be EXACTLY what you're looking for because you mentioned you wanted a list of files that were "read" as opposed to "modified" but it might be a good starting point for you.

Just thought I'd mention it.

KPWINC
  • 11,394
  • 3
  • 37
  • 45