Monitor which process is deleting a file

[Sunny4Ever]

I support an application and one of the users is loosing log files which are being deleted by an unknown process. I need a script to monitor for file deletion events and then relate this back to the process which is doing this. I have the first part of the puzzle which is a WMI event consumer however I can only echo the name of the file when it is deleted and not the process responsible. Any scripting Guru out there that can suggest how to get the required functionallity?

-S

What I have so far:


strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & _
strComputer & "\root\cimv2")
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
("SELECT * FROM __InstanceDeletionEvent WITHIN 10 WHERE " _
& "Targetinstance ISA 'CIM_DirectoryContainsFile' and " _
& "TargetInstance.GroupComponent= " _
& "'Win32_Directory.Name=""D:\\\\temp""'")
Do
Set objLatestEvent = colMonitoredEvents.NextEvent
Wscript.Echo objLatestEvent.TargetInstance.PartComponent
Loop