Use process monitor to see what deletes a file