Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an installation of a very large Windows program, and I want to understand which files are actually read while I install the program, which my specific setup.

Is there a way to monitor this and get a list of files which were read?

I looked at Process Monitor, and I can put a filter on the directory I want to monitor, but I didn't find an easy way to get a list of files which were opened in that directory.

share|improve this question

Filemon from sysinternals will allow you to see what files are accessed in real time. You can run filemon and then go through your program installation and monitor what files were accessed.

As Jim B has commented, Process Monitor has replaced Filemon. As a further note to the original questioner, when you filter in Process Monitor, make sure your filter is "Path" "contains" rather than "Path" "is". If you do Path is, it just shows the path you specified in the path field/column and you no longer see the actual file names. Using "contains" preserves the file names so you can see what is accessed in that directory.

share|improve this answer
Filemon was long ago replaced by process monitor – Jim B Jul 20 '09 at 0:26

Windows (optionally) keeps access times (atimes), you can use those to get your information, however I don't have any ideas on a good, simple method to make use of them.

share|improve this answer

You could use a snapshotting tool such as regshot.

share|improve this answer
regshot is a nice suggestion, but it can't tell me which files have been read, only which files are added , for example after installation, and which registry entries are added. – gala Jul 19 '09 at 15:21

If procmon is not helping you (which makes me wonder why) as an alternative you can pull out the big guns and use xperf (blog post, download) Based on event tracing for windows, this can tell you more than you ever wanted to know about what happened to what and when on a windows system.

share|improve this answer

There is a commercial program called PA File Sight that may be easier to set up and use than Filemon. They offer a fully functional 30-day free trial.

share|improve this answer


Have you taken a look at InstallWatch?

InstallWatch is FREE and records modifications made to your PC during the installation of software, hardware, or configuration changes.

You can find it here:

Note: This might not be EXACTLY what you're looking for because you mentioned you wanted a list of files that were "read" as opposed to "modified" but it might be a good starting point for you.

Just thought I'd mention it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.