Find all files connected with a program on disk... - Page 1
Forum section: electronics / general

author: MathWizard
author_rank: Super Contributor
timestamp: January 06, 2021, 12:30:01 am
content: I'm playing an old Star Trek game, ST:Armada 2 with Fleet-Ops ,some re-worked magic so that it runs well in win10. But I can't find the dam save game location, I want to delete my old saves, and doing it in the games UI, is extra tedious and slow.I know in the past I would delete the saves no problem, but now I don't know the new location.Searching the net for the save location hasn't helped yet, I don't see it in appdata, or my doc's, games, and I can't find the file extension name to search for.But since I know exactly where the game is, and all the core files, is there some simple search, or program that can list all files that get run/created/associated, with any other file I want ? Surely windows does this all the timeWhat should I try ?

author: JohnnyMalaria
author_rank: Super Contributor
timestamp: January 06, 2021, 02:15:09 am
content: I recommend using WinDirStat. It's not really a file search tool as such but it gives you a great way to see where everything is.You could also run dir from the command prompt and pipe the results into a text file. Clunky but effective. You can limit what it returns but you have to look up the syntax.There are also tools that will monitor all file operations so you could use one of those while running the game to log what files are being accessed etc. I recommend this:https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

author: nightfire
author_rank: Frequent Contributor
timestamp: January 06, 2021, 02:42:29 am
content: The hard way would be to use procmon (also from sysinternals) and watch while the program execution all function calls- and filter then for disk access to the savegame files...

author: T3sl4co1l
author_rank: Super Contributor
timestamp: January 06, 2021, 03:39:44 am
content: You've checked the likely suspects (My Documents subfolder, Program Data, AppData/Roaming or Local)?Not many other places it could/should be. Maybe Registry.Can't find info on the wiki or anything? Most games have that kind of info around...Tim

author: JohnnyMalaria
author_rank: Super Contributor
timestamp: January 06, 2021, 03:55:13 am
content: Any clues on this page?https://www.pcgamingwiki.com/wiki/Star_Trek:_Armada_II(particularly the footnote 1).Quote

author: nightfire
author_rank: Frequent Contributor
timestamp: January 06, 2021, 04:37:01 am
content: Found this, maybe it helps?https://www.fleetops.net/forums/general/where-are-saved-games-kept-9301

author: ebastler
author_rank: Super Contributor
timestamp: January 07, 2021, 10:07:54 pm
content: Do you know (part of) the filename or the extension? Then I recommend "Everything", an extremely fast, lightweight file search tool. It will only find files by name, or part of the name, but it does that pretty much instantaneously, with the help of a file index it collects silently and efficiently.https://www.voidtools.com/I don't recall who recommended it to me (might even have been on this forum?), but I am forever grateful to that unknown benefactor.

author: Bud
author_rank: Super Contributor
timestamp: January 07, 2021, 11:08:55 pm
content: Save a game and search the drives for the latest files timestamps.

author: Whales
author_rank: Super Contributor
timestamp: January 07, 2021, 11:29:42 pm
content: Quote from: nightfire on January 06, 2021, 02:42:29 amProcess explorer helped me the other day on a Win10 box trying to find where a program was temporarily stashing a PDF before calling Adobe reader on it.Zsoft uninstaller can take disk index + registry index snapshots and compare them between two runs. It's officially for working out what installers do, but it also works to see where config files & save files are kept.I get into this situation far too often with Windows games on my Linux box. Luckily I can do something like "strace -f wine game.exe 2>&1 | grep drive_c" and get a list ofallfiles the program opens or writes to, but that's not an option for most users :|

author: Nominal Animal
author_rank: Super Contributor
timestamp: January 07, 2021, 11:55:26 pm
content: Just for completeness, if any Linux users end up having the same question, and find this thread:In Debian-derivative Linux distributions (Debian, Ubuntu, Mint, etc.) one can rundpkg-query -S $(whichbinary)ordpkg-query -Spath-to-fileto find the name of the package providing a command or a specific path; anddpkg-query -Lpackageordpkg-query -L $(dpkg-query -S $(whichbinary) | cut -d ':' -f 1)ordpkg-query -L $(dpkg-query -Spath-to-file| cut -d ':' -f 1)to get the complete file listing.

author: Whales
author_rank: Super Contributor
timestamp: January 08, 2021, 04:52:35 am
content: Note: dpkg is only used in Debian derived distros (Debian, Ubuntu, Mint, etc). All good package managers will have similar features however. My pet peeve is when a package of 'name' installs a binary of 'Name', ie capitalised

author: Nominal Animal
author_rank: Super Contributor
timestamp: January 08, 2021, 06:00:39 am
content: Quote from: Whales on January 08, 2021, 04:52:35 amAbsolutely true – I would have included the commands for rpm, but don't have a distro installed using rpm packages, and was too lazy to go look them up online.I do wonder why Microsoft and Apple haven't switched to package management?It does not need to impact existing installation methods – you can still install software by hand on all Linux distros just fine, even viasudo make installif you are brave –, so backwards compatibility definitely isn't the reason.Then again, "package management" itself – as a software engineering problem/pattern – is still in flux. You have installers that put stuff at registered locations, and then you have zero-install ones like AppImage, Flatpak, and Snap that use filesystem images. Perhaps they just haven't found one that works best for all their users?

author: helius
author_rank: Super Contributor
timestamp: January 08, 2021, 06:25:10 am
content: Theactualway one finds files used by a program islsofand/ordtraceorbpftrace.

author: Whales
author_rank: Super Contributor
timestamp: January 08, 2021, 06:38:48 am
content: Quote from: Nominal Animal on January 08, 2021, 06:00:39 amThey have for Windows Updates.Technically also an uninstaller registration is also a form of package management, but in the Win world they are only centrally listed (not centrally performed). *nix package managers are very strict in comparison, but I'd argue both options are still in the same universe.

author: Nominal Animal
author_rank: Super Contributor
timestamp: January 08, 2021, 06:44:06 am
content: Quote from: helius on January 08, 2021, 06:25:10 amThere is a difference between "connected" (or "associated with") and "used". I was talking about the former.That said, on Linux, I usestrace -f -e open,openat,lstat,lstat64,stat,stat64 -ologfileprogram[args...]to find out which files a program uses: opens or examines the metadata for. Thelogfilewill list all files (including dynamic libraries) accessed, and the access flags (read-only, read-write, et cetera). Whales already showed how they use it with Wine, running Windows binaries in Linux (although I prefer my stanza).Quote from: Whales on January 08, 2021, 06:38:48 amRight! I didn't think of that; thanks.