>As a start goto www.sysinternals.com and download (for free):
>
>Process Explorer for Windows (procexp.exe)
>
>and
>
>Diskmon (diskmon.exe)
>
>The first one in particular will be of great help.

Great tools. thanks for the link. The DiskMon does not show the source of the write(program name). What I'm tring to do is locate the program source it may be Xcopy or a program such as winzip, etc. Not sure.