Get process which changed FileInfo.lastAccessTime or FileInfo.lastWriteTime

Is it possible to find the process which ch开发者_开发知识库anged the FileInfo.lastAccessTime or FileInfo.lastWriteTime of a File?

As David says, I do not think this is possible since I don't think this information is stored in any of the meta data for the files. However, you might be able to do it in some way by turning on auditing, look at this link for more details (it's for XP but should be similar for Vista and 7):

http://support.microsoft.com/kb/310399

As far as I know, all Operating Systems do not track this information for IO performance reasons.

You can implement a file watcher using FileSystemWatcher. Here's very simple example:

http://www.csharphelp.com/2006/11/file-watcher-utility/

And then get a process snap shot at the time from one of the event handlers