Tracing which process that has opened a particular file

Question

From kernel mode in Windows I\'m able to intercept and monitor virtually all actions performed on a particular disk. When a file is opened for any purpose I get an event.

Answer 1

Just use Win32 N.API to get the pid from the File handle. It's a FAQ for 15 years...