Comments by Aner Izraeli (Top 5 by date)

Shalom Eliyahu, thanks for replying :)
yes, you can link file to his process.
the great process explorer (sysinternal tool) can do it, so it`s possible.
that`s what im looking for, some Command line tool that`s able to hook a process and tell which files have been created by him.
i even buy one if found one.

Thanks! check those two suggestions.
it`s a solution for current handeled files\modules.
im looking for previous handeled file by a process.
for example:
1. a process helloworld.exe loaded.
2. the process creating a file - "testfile.bat"

I want to know that testfile.bat was created by helloworld.exe.

hope im more clear.
Thanks :)

no,
im talking about which file created\deleted\renamed right now, by a process.

think of a malware approach,
you cant know in which folder the malware will create\delete\rename files.
if i would know the folder path, than i can easly use filewatcher. :)