Ask HN: What is the best way to see what files are being read in Windows?

sysinternals

The most approachable way is to use Procmon from the Sysinternals tools released by Microsoft.

https://learn.microsoft.com/en-us/sysinternals/downloads/pro...

Here's a good, basic video tutorial from Scott Hanselman, explainer extraordinaire:

https://www.youtube.com/watch?v=pjKNx41Ubxw

generally you need a process, or file hook; or you want to monitor API calls of running processes

https://kevgo.dev/posts/fs_capture/

https://github.com/evandowning/windbg-trace

for reference, your goal is to detect operations on files and report file, i.e. build a process monitor that you can trust and have granular control.

https://learn.microsoft.com/en-us/windows/win32/api/fileapi/...

the system calls have consequences and results that you may use for your way of detecting file status. very oversimple example is just try to do something to a file, and look at results. if the file is unused, you will get results; if the file is busy, you will get some sort of exception or system flag.

return value:

https://learn.microsoft.com/en-us/windows/win32/api/fileapi/...

GetLastError:

https://learn.microsoft.com/en-us/windows/win32/api/errhandl...

also for reference :

https://learn.microsoft.com/en-us/windows/win32/api/