I think this is what you're looking for:
http://www.sysinternals.com/ntw2k/source/filemon.shtml

Quote from page:
"Filemon monitors and displays file system activity on a system in
real-time. Its advanced capabilities make it a powerful tool for
exploring the way Windows works, seeing how applicat...

[ more ]