Help With ProcMon

[filmteknik]

I used ProcMon to get a playlist long ago. In that case I skimmed through the disk taking notes on files being accessed. Trying the same now but it's different Windows install. Forgot what I did back then. I'm using Procmon64 (Windows 10 machine). I've tried the filters this and other sites recommend and in many cases I end up with 100% filtration (nothing shows up) or I'm seeing .m2ts files being accessed but not the actual file names. (Yes, running in administrator mode.) I'm playing the disk on Leawo. How do I see file names?

I thought perhaps it had something to do with using a desktop BD drive connected via adapters via USB so I moved it to a SATA connection but no change. Maybe this isn't a question of filters but something with the columns in ProcMon?

[Ezatoka]

First of all: Leawo uses parts of MakeMKV witout asking the devs of MakeMKV. See the warning at viewtopic.php?f=5&t=1514

As of today their BluRay Ripper still contains various (outdated) MakeMKV executables:

(https://i.imgur.com/QeL9uN2.png if the picture isn't shown).

For your problem:
What kind of filters have you added? I'd go with something like PATH contains .mpls (or .m2ts depending on what you want to see).

(https://i.imgur.com/FUtdlF5.png if the picture isn't shown).

You could filter to the application itself as well, though considering there might not be any other programs accessing the files in this moment, I'd go with a clean filter (hit the Reset button) and just go with the path.

[filmteknik]

I left the generic exclude filters and added

Process Name Includes Leawo (include)
Path Ends with .m2ts (include)

This results in 100% block. Same if I drop the period and go with m2ts. No change if I alter that filter to "path includes".

Adding "path includes" e: (my BD drive) gives me hits but they just say e: with no file name. Maybe there is something I need to do to see file names.

No luck looking for the playlist file either.

I've opened Windows Resmon and under disk I see only the C: drive, nothing for D: or E: the former being the DVD drive.

[AstralWanderer]

Adding "path includes" e: (my BD drive) gives me hits but they just say e: with no file name. Maybe there is something I need to do to see file names...

ProcMon can only report filenames for processes that use standard (Windows) file access routines. If a process (such as Leawo in this case) is reading data at block level, there will be no filename to report.

In such a case, checking for any log files generated by Leawo (just use the Leawo filter you mentioned above and once you've stopped capturing events, disable all the "Show..." icons other than file system activity to find any) would be your best bet.

[filmteknik]

Hmm...that is curious. I wonder what I did a few years back. In that case it was the movie LaLa Land with full on obfuscation - maybe spread over a dozen files - and I was definitely taking notes of m2ts files (not a playlist) as it played and I skipped ahead. It was almost certainly Leawo but maybe an earlier version did things differently and most likely I used ProcMon unless there is something else that can see file names.

I wonder why suggestions even on this site say one can see file names in Procmon.