you could probably use filemon from sysinternals link