是否有可能知道哪个应用程序创建的文件？ [英] Is it possible to tell which application created a file?

问题描述

难道Windows（或NTFS一般）存储中创建的文件的任何地方应用程序的名称？

Does Windows (or NTFS in general) store the name of the application that created a file anywhere?

或者是有确定哪些应用程序负责很快创建文件的一个有效的方法，（几秒钟，说的），它在最初创建后？

Alternatively is there a robust way of determining which application is responsible for creating a file soon (a few seconds, say) after it is initially created?

我们正在处理一个文档管理系统。它监视FS的新文件，FileSystemWatcher的 - 这部分的简单 - 但我想它要能跟踪哪些应用程序/版本创建会检测到新的文件

We're working on a document management system. It monitors the FS for new files with FileSystemWatcher - that part's straightforward - but I'd like for it to be able to keep track of which application/version created the new files it detects.

我知道我可以寻找属于正在运行的进程，但$ P $打开的文件句柄psumably时，应用程序已创建的文件，然后保存就可以了锁，正确的做法只会工作？有没有更好的办法？

I know I can look for open file handles belonging to running processes but presumably that approach would only work when the app has created the file and then kept the lock on it, right? Is there a better way?

推荐答案

没有，而不是事后。

不过，你可以存取创建观看所有文件的服务，并记录自己，FileMon的从系统内部执行此操作的信息。 （它实现了坐落在NTFS驱动程序之上的操作系统驱动程序）

However you could create a service to watch all file accesses and record the information yourself, FileMon from System Internals does this. (It implements a OS driver that sits on top of the NTFS driver)

这篇关于是否有可能知道哪个应用程序创建的文件？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！