Logging file access by your application

Previous Top Next

Obtaining a complete list of files used by your program:

When "Log all files accessed" or "Log Everything" or "JIT logging" is enabled, the trace -> .txt report will list all files accessed at the end of the log. This should look something like:

---- File Access ---
EXTERNAL C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\COMCTL32.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\ADVAPI32.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\GDI32.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\MSVCP60.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\NETAPI32.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\OLEAUT32.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\RICHED20.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\RPCRT4.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\SHELL32.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\SHLWAPI.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\USER32.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\VERSION.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\WINSTA.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\WS2HELP.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\WS2_32.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\WSOCK32.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\comdlg32.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\kernel32.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\msvcrt.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\ntdll.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\ole32.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\riched32.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\utildll.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL C:\WINDOWS\system32\wtsapi32.dll, DesiredAccess=(80000000=GENERIC_READ, 80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING, 3=OPEN_EXISTING)
EXTERNAL C:\thinstest\742\102805\archive\smartclient.archive.tsp, DesiredAccess=(80000000=GENERIC_READ, 80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING, 3=OPEN_EXISTING)
EXTERNAL C:\thinstest\742\102805\archive\smartclient.archive.tsp.tmp, DesiredAccess=(c0000000=GENERIC_READ| GENERIC_WRITE, 80000000=GENERIC_READ)CreateDisposition=(2=CREATE_ALWAYS, 3=OPEN_EXISTING)
EXTERNAL X:\thinstall/art/logo.bmp, DesiredAccess=(80000000=GENERIC_READ, 80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING, 3=OPEN_EXISTING)
EXTERNAL X:\thinstall/art/tip.bmp, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL X:\thinstall/thinstall.scm, DesiredAccess=(80000000=GENERIC_READ, 80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING, 3=OPEN_EXISTING)
EXTERNAL X:\thinstall/tips.rtf, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL X:\thinstall\connect.scm, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL \\xeon\profiles\jclark\Application Data\Thinstall\shroud.settings, DesiredAccess=(80000000=GENERIC_READ, c0000000=GENERIC_READ| GENERIC_WRITE)CreateDisposition=(3=OPEN_EXISTING, 2=CREATE_ALWAYS)
EXTERNAL \\xeon\profiles\jclark\Application Data\Thinstall\thinstall.settings, DesiredAccess=(80000000=GENERIC_READ, c0000000=GENERIC_READ| GENERIC_WRITE, c0000000=GENERIC_READ| GENERIC_WRITE)CreateDisposition=(3=OPEN_EXISTING, 2=CREATE_ALWAYS, 2=CREATE_ALWAYS)
EXTERNAL c:\Program Files\Thinstall\thinstall.exe, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL c:\tmp\installo.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL c:\tmp\splashd.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
EXTERNAL c:\tmp\vregistryd.dll, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
CACHED c:\Program Files\Thinstall\shfolder.dll, DesiredAccess=(80000000=GENERIC_READ, 80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING, 3=OPEN_EXISTING)
CACHED c:\Program Files\Thinstall\statusbard.dll, DesiredAccess=(80000000=GENERIC_READ, 80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING, 3=OPEN_EXISTING)
CACHED c:\Program Files\Thinstall\thinstall.exe.install_data, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
CACHED c:\Program Files\Thinstall\thinstall.exe.slic, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
CACHED c:\Program Files\Thinstall\thinstall.exe.splash.bmp, DesiredAccess=(80000000=GENERIC_READ, 80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING, 3=OPEN_EXISTING)
CACHED c:\Program Files\Thinstall\thinstall.exe.splash.config, DesiredAccess=(80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING)
CACHED c:\tmp\DBGHELP.DLL, DesiredAccess=(80000000=GENERIC_READ, 80000000=GENERIC_READ)CreateDisposition=(3=OPEN_EXISTING, 3=OPEN_EXISTING)

Note: Files that are opened as "EXTERNAL" use the filesystem as their data source. Files listed as "CACHED" used the Thinstall Virtual Filesystem as their data source.