FileActivityWatch

Given the vast number of processes working in the background performing system or their own tasks, it is almost impossible to keep a close eye on what is being modified and with what purpose on your computer. To put it simply, it can be quite challenging to identify writing, deletion or modifications made by a particular file at a given time through the tools provided by Windows.

FileActivityWatch is a dedicated tool that displays all file operations that happen on your operating system in real time along with their paths, processes responsible and timestamp.

The program comes with a clean interface that can be configured to resemble a table, so you can easily keep an eye on the activity of the file you are interested in. Depending on your needs and preferences, you can configure the tool to capture all events, solely the ones that read or write and deletion activities. Moreover, set it to mark the files with an active read and write activity.

In addition to the filename, the utility displays other critical information that can help you determine whether you are dealing with a potentially malicious file. More precisely, you can find out the process ID and name, read and write bytes, read and write counts, delete count, first read and write time, last read and write time and the process's path.

On the other hand, it is worth mentioning that the program cannot read detect reading, writing and other modification operations that happened after the tool was opened. Consequentially, if you are testing out something, you may need to restart the application to determine the changes. A reset button could probably fix this inconvenience.

Despite the mishap, FileActivityWatch is an easy-to-use tool that allows you to grab all changes happening on your operating system when you launch an experimental tool or when you notice an unusual behavior of a particular file.