Using procmon to monitor file access