How to get the process which deleted my file

Maybe you could watch the folder(s) the files are in, using FileSystemWatcher, and check the sender of a Delete action in the handler of the Deleted event.

Actually this proposal is just "a shot in the blue".

I don't know if the sender somehow refers to the deleting process or it's say the OS or the kernel IO subsystem itself.

Note also, that this would require a service or sth similar to be active, all the time the system is running, in the background.

Also, you could protect these files through ownership and other windows rights&security stuff.

hth,

Chris