Save Process Activity Snapshots in Process Explorer

Learn how to save Process Explorer process activity as a tab-delimited text snapshot, including visible columns and lower-pane details.

A snapshot is a saved, point-in-time record of the information currently displayed in Process Explorer. It is useful for documenting an incident, comparing behavior before and after a change, reviewing a performance condition, or sharing process details with a support team.

A snapshot is not a live report. After the file is saved, it does not update when processes start, stop, or change resource usage.

What Process Explorer Saves

Process Explorer is a Windows process-inspection utility that displays running processes and related details. Its main Process pane lists processes and their displayed attributes. An optional lower pane shows additional information associated with a selected process.

The export reflects the view at the moment you save it:

Area	Included when saved	How to control the content
Process pane	The contents of the main process list.	Arrange and inspect the process list before saving.
Lower pane	Included when the lower pane is visible.	Show the lower pane, select the relevant process, and choose the required lower-pane mode.
Displayed process columns	The columns currently shown in the Process pane.	Configure visible columns before exporting.
Selected process and lower-pane context	The selected process and the lower-pane details associated with it.	Select the target process and confirm that the desired details are visible.

This means the report contains only information visible in Process Explorer at save time. A process attribute that is not displayed as a column, or lower-pane information that is not visible, will not appear in the export.

Prepare the View Before Exporting

Configure the Process pane to show the identifiers and metrics needed for the investigation. Depending on the task, these may include process name, process ID, CPU usage, user, path, or command-line information.
If associated details are required, display the lower pane.
Select the process being investigated and choose the appropriate lower-pane display.
Inspect the desired state. For short-lived activity, prepare the view in advance and save promptly when the condition appears.

For related interface guidance, see Process Explorer display options, process properties, and the DLL view.

Save a Snapshot

Process Explorer provides two direct ways to start the save workflow:

Method	Action	Result
Toolbar	Click the Save icon on the Process Explorer toolbar.	Opens the save workflow for the current snapshot.
Keyboard shortcut	Press `Ctrl+S`.	Opens the save workflow for the current snapshot.

Use the Save toolbar icon or press Ctrl+S.
In the save dialog, choose the destination folder.
Enter a meaningful file name.
Confirm the save operation.

Useful names include the host, incident or test-case identifier, and capture time. For example, a name such as HOST01-highcpu-2026-08-19-1430 provides context without requiring the file to be opened first.

Snapshot File Format

Process Explorer writes the snapshot as a tab-delimited text file. This is a plain-text format in which fields are separated by tab characters.

Tab-delimited output can be opened in:

A text editor for direct inspection.
A spreadsheet application for filtering, sorting, and comparison.
Analysis tools that accept delimited text input.

If a spreadsheet places the entire row into one cell, use its import workflow and specify tab as the delimiter. The snapshot is a text report, not a proprietary session file or binary capture format. It should not be treated as a substitute for a memory dump or another specialized capture.

Practical Examples

Document a Suspected High-CPU Process

Arrange the Process pane to show process name, process ID, CPU usage, user, and command-line information as appropriate.
Wait until the high-usage condition is visible.
Save the snapshot with the toolbar Save icon or Ctrl+S.
Name the export with the incident identifier and timestamp.

The result is a text record of the process state and selected metrics visible during the performance event.

Capture Details for Escalation

Select the process being investigated.
Display the lower pane if associated details are needed.
Choose the required lower-pane mode and save the snapshot.
Review the text file before sharing it.

The export contains the main process list plus visible lower-pane details. Review and protect sensitive content according to organizational policy.

Compare Before-and-After Behavior

Save a baseline snapshot before starting a test.
Perform the application action or configuration change.
Save a second snapshot afterward.
Import both files into a spreadsheet or compare them with a text comparison tool.

Two point-in-time files make it possible to review differences in processes and displayed attributes across the test.

Use case	Recommended preparation	Follow-up use
Performance troubleshooting	Show resource columns and capture while the condition is visible.	Review process usage and compare with a normal-state snapshot.
Incident documentation	Include relevant identifiers, paths, users, and visible process details.	Attach or store the export using approved incident-handling procedures.
Before-and-after comparison	Use consistent columns and naming for both captures.	Sort, filter, or compare the two text files.
Support escalation	Show the target process and required lower-pane information.	Review for sensitive data before secure sharing.

Review and Use the Exported Data

Open the file directly in a text editor to verify that the expected process rows, columns, and lower-pane content were captured. For structured analysis, import the file into a spreadsheet as tab-delimited data. You can then filter processes, sort by a metric, compare columns, and place two snapshots side by side.

Use consistent labels for repeated captures. Include the time, host, incident number, test case, or application version when those details matter. Consistent naming and view configuration make later comparisons more reliable.

Limitations and Data Sensitivity

A snapshot captures only what Process Explorer displays at the time of saving. It does not preserve later changes, guarantee that a short-lived process was present, or include hidden columns and hidden lower-pane content.

Exports may contain sensitive operational information, including:

Process names and executable paths.
Command-line arguments.
User or account names.
Loaded modules, handles, or other lower-pane details.
Host-specific resource and configuration information.

Store and share snapshot files according to your organization’s security, privacy, and incident-response requirements. Before sending an export to another party, inspect it for confidential information and use an approved secure-sharing method.

Troubleshooting

Expected Lower-Pane Data Is Missing

The lower pane was probably not visible when the snapshot was saved. Display the lower pane, select the relevant process, choose the desired details, and save a new snapshot.

A Needed Process Attribute Is Absent

The attribute was likely not displayed as a Process pane column. Configure the Process pane to show the required column, then save another snapshot.

The File Is Difficult to Read in a Spreadsheet

The spreadsheet may not have recognized tab characters automatically. Reopen or import the file through the spreadsheet’s text-import workflow and specify tab as the field separator.

The Snapshot Shows an Older State

Process activity may have changed before the export was created. Prepare the view in advance and save immediately when the relevant condition appears.

The Report Cannot Be Safely Shared

Process names, paths, command lines, account names, and lower-pane details may reveal sensitive information. Review the file, follow applicable handling procedures, and use an approved secure-sharing method.