When you first start process monitor a dialog may open "Process Monitor Filter". If it doesn't, click on the funnel icon for Filter. Where is says "Display entries matching these conditions", change the first drop-down to "Path" and the second to "contains" and then put the filename part of your database name in the entry box (mynewdata) or possibly just (.db) if you want to watch for other names, ignoring the (). The 3rd drop-down should be "Include", then click "Add" and "OK". This will start capturing thousands of events but will only display the ones matching the filter you just added. Running the different approaches should show the Process Name of the application, what it was trying to do, and the full path of the file it was trying to open/create/read/write etc. Once you have stopped your app, you can click on the magnifying glass icon or press Ctrl-E to stop capturing while you look at the data you've go so far. As the earlier poster said, this is the way to really know what is happening. On my Win10 PC using the sqlite3.exe shell, trying (note that you have to use a / ) .open c:/testdb.sqlite create table fred...; .quit and process monitor shows it trying c:\testdb.sqlite and then moving on to c:\Users\myname\AppData\Local\VirtualStore\testdb.sqlite. You may also see access to .wal and .shm files with the same name as your database. You may find that other apps add their preferred database suffix (.db or .db3 or .sqlite or .sqlite3 etc) to what you enter if they don't recognise your choice of suffix. Hmmm, I have just repeated this test on my Win7/64 machine, and got the same result. I note that the sqlite3.exe is not signed, and has no manifest (which can prevent the redirection to the virtualstore leading to an application error). Trying to create c:\fred.sqlite using SQLiteStudio results in a dialog saying "You don't have permission to save in this location". Trying to open the supposedly created c:\testdb.sqlite in SQLiteStudio returns a "Could not add database" and Process Monitor shows there's no attempt to access the VirtualStore. Len.