If I were doing that I'd create a shortcut to the folder and put it on
my task bar to regularly check it. Just a thought. ;-)
You could try Sysinternals Process Monitor.
Download and unzip.
The way that program works, it is traces stuff (operations done by processes,
such as file operations or registry operatons). By default, I think it
uses RAM based storage, so for long traces, it may exhaust resources.
There is another option for that.
The key to the program, is the "Filter" dialog. Since you're looking
for a needle in a haystack, the Filter is how you narrow down your
The Filter menu has many options. For example, right now I tried...
Path begins with C:\Downloads Include
Operation is Readfile Include
If I then create a directory with Explorer, in C:\Downloads, such
as C:\Downloads\New Folder, that seems to trigger this kind of activity
in the capture window -
Explorer PID 292 ReadFile C:\Downloads\New Folder INVALID PARAMETER
and I now know that Explorer did it.
I don't know exactly what Explorer is doing at that moment, but at
least it triggered the name of the process to be captured.
I could not find a "CreateDirectory" option in the Operation filter
event. So I couldn't precisely specify the capture of a process
creating a folder. So I tried ReadEile, in that directory.
I expect, there is plenty of ReadFile activity in
so even that is not going to be specific enough to catch it.
Maybe you could change the "Path begins with" filter to include
the first character before the GUID, like this ?
and catch it that way. Only the guilty folders should get
For long term operation of Process Monitor, you should
set the captures to go into a "backing file" rather than
using system RAM as the default. Then you can leave it
running for a longer period of time. Look under the "File"
menu for "Backing File" setting, then find an NTFS partition
on your hard drive (preferably not in the AppData folder
and have the program store the trace in there. If you have
a few hundred gigabytes of space on that volume, who knows
what you might capture.