Anyways, can this work with a mounted USB drive?
The USB only has a total of 8.5MB on it, is that also right?
I do believe that SeaTools for DOS will work from a USB stick, but then again, I've always executed it from a burnt CD and never tried a USB stick -- so I really don't know.
Hello again, so I have process monitor open and it's been "Showing events" for 25 minutes now, up to 10,000,000+ events. Am I supposed to wait for it to finish then get a report?
25 minutes should be more than enough - as long as the drive in question was accessed. As you witnessed, ProcMon can easily log millions of records in mere minutes.
ProcMon writes directly to the page file and will continue until your virtual memory nearly runs out, which will bring your system to an absolute crawl and cause it to be non-responsive. By the time that happens, you will have lost the ProcMon file as you would need to do a hard shut-down to regain control of your system.
And about Take Ownership, I have the option when I right click on a subfolder or a file only. When I right click directly on the drive from This PC, there is no Take Ownership option there. That's the same with any other drives I connect.
OK - my apologies. I wasn't sure whether it would let you take ownership of an entire drive or not.
Oh, and I saved a log file for Process Monitor but it was 12GB haha
I didn't quite understand what it was doing so I left it open 2 hours
You want to open that PML (I think that that's the ProcMon file extension) file with ProcMon. After successful import, click on "Tools" in the menu options up-top; then select "file summary"; then select "by path" to start with. Then scroll down the output looking for the drive letter of the drive in question among the file names in the last column - all the way to the right.
If you find the drive letter, go to left side of that line and expand it (click on the
+ sign) and see whatever info it provides. Hopefilly it will give us enough info to figure out what is "using" the file on the drive in question.
An alternative to allow me to view the PML file - Try and ZIP the ProcMon file (RIGHT-click on the PML file; select "send to"; "compressed (zipped) folder". It will create a ZIP file with the exact name of the PML file in the folder you are in.
What is its size?
Perhaps you can upload it zipped to One Drive or Google so that I can download it...?
But only do so if you see the drive letter for the drive listed in TOOLS; BY EXT
If the drive letter does not show up, you'll have to let ProcMon run a lot longer to pick up more data. Also, while ProcMon is running, use your system as you normally do. Maybe something you're doing is accessing that file.
Got all of that?? :0 -- If not, please feel free to ask any and all questions. ProcMon can be overwhelming for first-time users. I know that I was when first using it some 10 years ago.
Regards. . .
John