Here are some suggestions: If you are on *nix you can list all the files that a process is using: $ lsof -p <PID>,<PID>,<PID> Then do a diff of the listed fil

Here are some suggestions: If you are on *nix you can list all the files that a process is using: $ lsof -p <PID>,<PID>,<PID> Then do a diff of the listed files against older versions of the files (e.g from a backup). On Windows you can use procmon.exe (its a free tool from Microsoft that lists all network, registry and files) and see the updates in realtime. Hope those work.