On Fri, 1 Feb 2019 14:02:13 -0800, T wrote:

Also, I am not sure sysinternals will tell you "what",
but if so, I learn something new every day!

Hi T,
I need to log just the one exact "thing" that _wrote_ to X: overnight.

I am sort of responding to everyone here who kindly offered advice.
But I have no new news to report as I need to run the tests first.

I think I see this problem differently than most of those who posted.
I think it will be like trying to find a spelling error in a Latin encyclopedia.

But I could easily be wrong.
But I think the answer will be a royal unmitigated bitch to figure out.

Maybe not.
But if the output is a zillion items, then it will be almost impossible.
The output should be _only_ the exact moment when _something_
literally _writes_ to the given removable drive, (X.

If something didn't literally _write_ to X:, then the output should
be nothing. And it has to _know_ this over a period of 24 hours.

This won't work:
1. If the output looks like a latin encyclopedia, or,
2. If the output has to be watched in real time.

Literally, the output should be trivial:
A. What _wrote_ to X: overnight

That's it.
I need to log just the one exact "thing" that _wrote_ to X: overnight.