Find process that created a file on windows

file, process, windows

Solution

In general, no. Windows does not record the process that created a given file.

You might be able to use something like SysInternals Process Monitor, which hooks file (and registry I/O), to see if you can catch the file being created, but once it's created (and the last file handle is closed), Windows forgets which process it came from.

If the file is open in a process that's currently running, you can use Process Explorer (also from SysInternals) to find out which one.

If you recognise the file extension, that can sometimes help. Or, maybe you can look in the file to see if there's anything obvious in it.

Problem

Original source